The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has imposed a $1,500,000 civil money penalty against Warby Parker, Inc., following a cybersecurity breach that compromised the protected health information (PHI) of nearly 200,000 individuals. Between September and November 2018, unauthorized third parties exploited “credential stuffing” attacks—using credentials obtained from unrelated breaches—to access customer accounts. Subsequent similar breaches occurred in April 2020 and June 2022.This enforcement action underscores the necessity for organizations to proactively safeguard ePHI and comply with HIPAA Security Rule requirements to avoid substantial penalties and protect consumer trust.
Key Takeaways for Healthcare Entities:
-
Comprehensive Risk Analysis: Ensure your organization conducts thorough risk assessments to identify and address vulnerabilities in electronic PHI (ePHI) systems. HHS has recently taken a strict approach to scrutinizing the existence and substance of risk assessments. Therefore, it is important to ensure your risk assessment is carefully crafted to pass legal scrutiny.
-
Robust Security Measures: Implement and regularly update security protocols to mitigate identified risks to ePHI.
-
Continuous Monitoring: Establish procedures for ongoing review of information system activities to detect and respond to unauthorized access promptly.
-
Credential Management: Be vigilant against credential stuffing attacks by enforcing strong password policies and multi-factor authentication.
Original Article: “HHS Office for Civil Rights Imposes a $1,500,000 Civil Money Penalty Against Warby Parker in HIPAA Cybersecurity Hacking Investigation,” HHS.gov, February 20, 2025, https://www.hhs.gov/about/news/2025/02/20/hhs-imposes-1500000-penalty-against-warby-parker-hipaa-hacking.html