On April 23, 2026, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) announced settlements with four health entities following investigations into ransomware breaches that exposed unsecured electronic protected health information (“ePHI”). While ransomware enforcement actions are not new, one of the four settlements stands out as a landmark: for







