◆ Banner Health Affiliated Covered Entities, a nonprofit health system in Phoenix, Arizona, agreed to pay $1.25 million in a settlement of potential HIPAA Security Rule violations, the HHS Office for Civil Rights (OCR) said Feb. 2.^[1] The settlement resolves a data breach stemming from a 2016 hacking incident by a threat actor that resulted in the disclosure of the electronic protected health information of 2.81 million people. Banner Health also must implement a corrective action plan. It didn’t admit liability in the settlement.