The investigation began in 2018 after Warby Parker reported a HIPAA breach to OCR, revealing that its website was targeted.