HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 20, 2018.
- Organization as reported
- Warby Parker Inc. (f/k/a JAND Inc. d/b/a Warby Parker), NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Dec. 20, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13591, row:4730)
- Archived copy
- Held in the private archive (provenance)
Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a $1,500,000 civil money penalty against Warby Parker, Inc., a manufacturer and online retailer of prescription and non-prescription eyewear, concerning violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, following the receipt of a breach report regarding the unauthorized access by one or more third parties to customer accounts. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules (the HIPAA Rules), which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of protected health information (PHI). The HIPAA Security Rule establishes national standards to protect individuals' electronic PHI (ePHI) that is created, received, used, disclosed, maintained, or transmitted by a covered entity. It also requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, availability, and security of ePHI. The civil money penalty resolves OCR’s investigation concerning this breach investigation. “Identifying and addressing potential risks and vulnerabilities to electronic protected health information is necessary for effective cybersecurity and compliance with the HIPAA Security Rule,” said OCR Acting Director Anthony Archeval. “Protecting individuals’ electronic health information means regulated entities need to be vigilant in implementing and complying with the Security Rule requirements before they experience a breach.” In December 2018, OCR initiated an investigation following receipt of a breach report filed by Warby Parker. The report stated that in November 2018, Warby Parker became aware of unusual, attempted log-in activity on its website. Warby Parker reported that between September 25, 2018, and November 30,…