Omni Healthcare and Western Montana Clinic Breach Settlements: A Compliance Officer’s Playbook

August 11, 2026

Ready to be survey-ready?

See how AccrediCulture turns compliance into an operating system across every facility.

The short answer: three failures OCR keeps finding

The Omni Healthcare and Western Montana Clinic class action settlements expose three recurring failures that HHS Office for Civil Rights investigators and plaintiffs’ counsel target in every healthcare breach case: delayed detection of unauthorized access, weak access controls under the HIPAA Security Rule (45 CFR Part 164, Subpart C, §§164.308-312), and patient notification that arrives too close to, or past, the 60-day deadline in the Breach Notification Rule (45 CFR §§164.400-414). Treat both settlements as a checklist, not a headline.

Omni Healthcare Financial Holdings settled a case tied to a January 2024 network intrusion. HIPAA Journal reports that Omni Healthcare Financial Holdings, along with defendants Omni Healthcare Financial, LLC, and Injury Finance, LLC, have settled class action litigation over a January 2024 cybersecurity incident involving the protected health information of 16,852 individuals. The exposed data set was broad: names, contact information, dates of birth, Social Security numbers, diagnosis and treatment information, medical record numbers, treatment costs, provider names, and other information.

Western Montana Clinic, a Missoula medical group, settled a case rooted in a compromised employee email account. The cybersecurity incident impacted the personally identifying and health information of 9,506 individuals. Western Montana Clinic agreed to settle a class action lawsuit claiming a data breach in which an unauthorized third party accessed an employee’s email account potentially exposed sensitive patient information. Different attack vectors, same operator lessons.

What each case tells you about your own program

Read the two fact patterns together and the failure modes line up cleanly against the Security Rule’s administrative, physical, and technical safeguards.

Detection lag. The Omni intrusion window was tight (roughly January 18-19, 2024), yet class notice arrived months later. According to IBM’s 2025 Cost of a Data Breach Report, healthcare data breaches took the longest to identify and contain, at an average of 279 days, five weeks longer than the global average breach lifecycle. If your SIEM, email security, and access log reviews cannot beat that number, you are the industry average, and the industry average is what plaintiffs’ counsel is suing.
Access control gaps. Western Montana Clinic’s case pivots on a single employee email account. That is a §164.312(a) technical safeguard problem (unique user identification, automatic logoff, encryption) and a §164.308(a)(5) workforce training problem. Multi-factor authentication on email would have shortened the story.
Notification timing. Omni Family Health, a separately named California nonprofit that settled a parallel $6.5M case, illustrates the timeline risk. The class action lawsuit originated from a data breach on August 7, 2024, that impacted the personal information of current and former patients and employees. According to the lawsuit, Omni Family Health did not disclose that the data breach occurred and that PHI had been posted online until October 10, 2024. That is roughly 64 days between discovery and public notice, right on the edge of the HIPAA 60-day rule and squarely inside the zone where plaintiffs argue delay.
Cost of getting it wrong. Healthcare has held the top spot in breach cost for more than a decade. The cost of healthcare data breaches in the United States dropped by $2.35 million year-over-year to an average of $7.42 million. While the cost of a healthcare data breach has fallen significantly, healthcare data breaches are still the costliest out of all industries studied by IBM, and have been for the past 14 years.

The command-center workflow: access log to CAP closure

Here is the chain a surveyor or OCR investigator will actually ask you to walk them through. Every link needs a timestamp and an owner.

Access log alert. Someone in IT or your MSSP flags anomalous authentication (impossible travel, off-hours mailbox rules, mass file access). Log it in your incident register within the hour.
Preliminary triage. Security and Compliance co-own a 24-hour triage note. Scope the accounts, systems, and record counts touched. Preserve logs before they roll off retention.
Risk assessment under 45 CFR §164.402. Document the four-factor analysis in writing: nature and extent of PHI, unauthorized person, whether PHI was actually acquired or viewed, mitigation. This is the artifact OCR requests first.
Notification decision. If the four-factor assessment cannot rule out compromise, presume breach. Draft individual notices, media notice (if 500+ in a state), and the HHS Secretary submission through the OCR Breach Portal. Track the 60-day clock from the date of discovery.
State AG and other notices. Montana and Florida both require attorney general notification for breaches meeting statutory thresholds. Build a state matrix and keep it current.
Corrective action plan. Write the CAP before OCR writes one for you. Include MFA rollout, phishing simulation cadence, log retention extension, workforce retraining, and access reviews with named owners and due dates.
Evidence package. Bundle the log excerpts, the four-factor memo, notice templates, mail vendor delivery reports, and CAP artifacts into a single, dated file. That is what closes the loop.

We help compliance teams run this exact sequence inside AccrediCulture, so incident intake, risk assessment, notification tracking, and CAP artifacts sit in one place with real-time visibility. When a surveyor or OCR investigator asks, you hand over a file, not a folder war.

A note from the settlement documents worth reading twice

Western Montana Clinic’s settlement filings include a line that captures why so many operators end up here even when their clinical care is strong. As HIPAA Journal noted in its coverage: “Western Montana Clinic denies wrongdoing and liability; however, it agreed to settle the lawsuit to avoid the litigation costs and expenses, distractions, burden, and disruption to its business operations associated with further litigation.”

Read that carefully. The clinic did not concede a Security Rule violation. It paid to end the disruption. That is the economic reality most compliance officers are managing every day: even a defensible incident, once it lands in federal court, costs enough to warrant a class fund. Both settlement structures show the pattern. Court documents state that the class action settlement covers approximately 42,000 people. Omni Healthcare settlement class members who submit a timely, valid claim form can receive up to $5,000 for documented out-of-pocket losses. Court documents state that roughly 9,506 people were mailed a notification about the Western Montana Clinic data breach. Western Montana Clinic settlement class members who file a timely, valid claim form can receive up to $5,000 for documented out-of-pocket losses.

The lesson is not fear. The lesson is that a documented, dated, four-factor risk assessment and a CAP with named owners is the single cheapest insurance policy in your program. Build it once. Run it every time. One incident at a time.

Frequently asked questions

What is the 60-day HIPAA breach notification deadline and when does the clock start?
Under 45 CFR §164.404, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. Discovery is the first day the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is a workforce member or agent. Do not let vendors tell you the clock starts at their investigation report. It starts at discovery.

Are class action settlements considered by OCR when determining civil monetary penalties?
OCR runs a separate track. A class action settlement resolves private civil claims; it does not preclude OCR investigation, resolution agreements, or civil money penalties under 45 CFR §160. That said, the corrective actions you agree to in a class settlement (new controls, monitoring, workforce training) often overlap with what OCR would demand in a resolution agreement, so document them like OCR is watching.

What Security Rule safeguards were most likely deficient in the Omni and Western Montana cases?
Based on public filings, expect scrutiny of §164.308(a)(1) risk analysis, §164.308(a)(5) security awareness and training, §164.312(a)(1) access control, §164.312(b) audit controls, and §164.312(d) person or entity authentication. An unauthorized email account access almost always implicates MFA and audit logging. For implementation-level guidance, NIST SP 800-66 Rev. 2 is the reference OCR itself points to.

Do covered entities have to notify state attorneys general in addition to HHS OCR?
Yes, in many states. Montana, Florida, California, New York, Texas, and others require attorney general notice when residents’ personal information is compromised, often on tighter timelines than HIPAA’s 60 days. Maintain a state notification matrix and update it whenever a state amends its data breach statute.

How should a compliance program document breach risk assessments to defend against enforcement?
Write a dated memo that walks through all four factors in 45 CFR §164.402: nature and extent of the PHI involved, who used or accessed it, whether the PHI was actually acquired or viewed, and the extent to which risk has been mitigated. Attach the underlying evidence (log excerpts, forensic report, mitigation steps). Store it where it cannot be edited without a version history. That single artifact, produced on demand, is often the difference between a resolution letter and a resolution agreement.

References