Aetna’s failure to follow the HIPAA Rules resulted in three breaches in a six-month period, leading to this million-dollar settlement,” said Office for Civil Rights (OCR) Director Roger Severino.