The HHS Office for Civil Rights (OCR) ended 2017 with a bang. A mighty big bang. But the whole year was pretty astounding.

With just four days left in the year, OCR announced its 10th and final settlement of 2017 for alleged HIPAA violations: $2.3 million with 21st Century Oncology (21CO), which bills itself as “the largest, physician-led provider of integrated cancer care services.”

While the amount itself wasn’t record-breaking, the settlement brought OCR a cumulative $19.4 million for the year, making 2017 OCR’s second highest for financial penalties collected (see story, p. 4). Top billing came in 2016, when OCR announced 13 enforcement actions totaling $24.5 million (RPP 12/16, p. 1).

Announced Dec. 28, the 21CO settlement also calls for a comprehensive, three-year corrective action plan (CAP) with numerous requirements, including the appointment of an external “assessor” (see story, p. 8). Also of note: OCR pursued the agreement while 21CO was in the middle of bankruptcy, a breach insurer was identified as the source for the $2.3 million payment, and it ends a seven-month drought of no settlements.

In the settlement, OCR describes 21CO as a “provider of cancer care services and radiation oncology. With their headquarters located in Fort Myers, Florida, 21CO operates and manages 179 treatment centers, including 143 centers located in 17 states and 36 centers located in seven countries in Latin America.”