SCROLL NEWS / DISCOVERY
Search headlines
Find the stories shaping the conversation.
Results for " HIPAA " 51 found 🔀 AI-powered Shuffle
Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits
Settlements have been agreed to resolve class action data breach lawsuits against Vida Y Salud-Health Systems & Hampton Regional Medical Center. Vida Settlements have been agreed to resolve class action data breach lawsuits against Vida Y Salud-Health Systems & Hampton Regional Medical Center.
$2 Million Settlement Resolves Covenant Health Data Breach Lawsuit
Covenant Health, St. Joseph Healthcare Foundation, St. Joseph Hospital, St. Joseph Hospital Nashua, N.H., and other Covenant Health facilities were named Covenant Health, St. Joseph Healthcare Foundation, St. Joseph Hospital, St. Joseph Hospital Nashua, N.H., and other Covenant Health facilities have agreed to pay $2 million to settle a class action lawsuit stemming from a May 2025 security incident.
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals
State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal and protected health Marathon Health, an Indiana-based employer-sponsored healthcare provider serving employees across the country, is notifying 5.7 million individuals that their data was compromised in an August 2026 security incident.
Cognitive Health Technologies Data Breach Affects 49,500 Individuals
Data breaches have been announced by Cognitive Health Technologies in New York, City Ambulance Service in Texas, Baraga County Memorial Hospital in Data breaches have been announced by Cognitive Health Technologies in New York, City Ambulance Service in Texas, Baraga County Memorial Hospital in Michigan, The Speech Clinic in Georgia, and Innovative Alternatives in Texas.
Lehigh Valley Health Network Pays $800K Penalty to Resolve HIPAA Violations
Lehigh Valley Health Network has agreed to settle alleged violations of the HIPAA Rules with the HHS’ Office for Civil Rights (OCR) and will pay an Lehigh Valley Health Network has agreed to pay an $800,000 financial penalty to resolve alleged violations of the HIPAA Privacy, Security, and Breach Notification Rules. The settlement stems from an investigation of a 2023 BlackCat ransomware attack involving the theft of the ePHI of almost 250,000 patients.
University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack
The University of New Mexico Health System (UNM Health) has experienced a cyberattack that has prevented access to critical electronic systems. The The University of New Mexico Health System, which operates the only level 1 trauma center in the state, is recovering from an October 26 ransomware attack that forced it to cancel appointments and temporarily divert ambulances.
Data Breach Announced by NorthShore Health Centers
NorthShore Health Centers, a nonprofit healthcare provider serving patients in Porter, Lake, La Porte, and Jasper Counties in Northwest Indiana, has A data privacy incident has been announced by NorthShore Health Centers in Northwest Indiana. The incident appears to have involved the theft of patient data. The scale of the data breach has yet to be determined.
Denver Health Medical Plan Discloses Vendor Breach Affecting 238K Members
Denver Health Medical Plan has notified more than 238,000 individuals about a vendor-related data incident. Data breaches have also been announced by Denver Health Medical Plan has notified more than 238,000 individuals about a vendor-related data incident. Data breaches have also been announced by Johns Hopkins Bayview Medical Center and BASS Medical Group.
Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR
Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR standard, that Four vulnerabilities have been identified in the HAPI FHIR open source component used in affect Smile Digital Health’s Smile CDR clinical data repository and health data platform.
Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit
Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action litigation that Jefferson County Health Department in Missouri has agreed to pay $2.25 million to settle a class action lawsuit stemming from a 2022 data breach affecting almost 116,000 individuals.
July 2026 Healthcare Data Breach Report
In July 2026, 77 healthcare data breaches affecting 500 or more individuals were reported to the U.S. Department of Health and Human Services (HHS) Office In July 2026, 77 healthcare data breaches affecting 500 or more individuals were reported to the HHS Office for Civil Rights, involving the protected health information of more than 33 million individuals. That’s a 10% month-over-month increase in data breaches and a 642% increase in affected individuals.
Photon Health; Healthcare Highways Announce Data Security Incidents
Data breaches have been announced by the New York-based healthcare technology company Photon Health, the Texas-based medical provider network company Data breaches have been announced by the New York-based healthcare technology company Photon Health, the Texas-based medical provider network company Healthcare Highways, and the New York-based home health agency Any-Time Home Care.
Valley Oaks Health Data Breach Settlement Gets First Nod from Court
Valley Oaks Health faced class action litigation over a June 2023 data security incident that affected 50,352 individuals. The consolidated lawsuit has Valley Oaks Health has agreed to settle a consolidated class action lawsuit stemming from a 2023 hacking incident that affected more than 50,000 individuals.
Bacon County Health Services Investigating Cyber Incident
Data breaches have been announced by Bacon County Health Services in Georgia, Comprehensive Orthopaedics & Musculoskeletal Care in Connecticut, Data breaches have been announced by Bacon County Health Services (GA), Comprehensive Orthopaedics & Musculoskeletal Care (CT), Imagine the Possibilities (IA), and Health Plans Inc. (MA).
WindRose Health Network Discloses Data Breach Affecting 33K Individuals
Data breaches have been announced by WindRose Health Network and Advantage Home Health Care in Indiana, Camden-on-Gauley Medical Center in West Virginia, WindRose Health Network in Indiana has reported a data breach affecting more than 33,000 individuals. Data breaches have also been reported by Advantage Home Health Care in Indiana, Camden-on-Gauley Medical Center in West Virginia, and Lakes Region Visiting Nursing Association in New Hampshire.
Senate Unanimously Passes the Health Care Cybersecurity and Resiliency Act
A bipartisan bill that seeks to improve healthcare cybersecurity and resilience has been unanimously passed by the U.S. Senate. The bill - The Health Care The U.S. Senate has voted unanimously to advance the Health Care Cybersecurity and Resiliency Act, which requires more robust cybersecurity measures for healthcare organizations and authorizes grants to help rural and under-resourced providers improve cybersecurity.
The Mental Health Association Data Breach Settlement Agreed
The Mental Health Association, a Chicopee, Massachusetts-based human services agency that provides substance use recovery and support services for The Mental Health Association, a Massachusetts-based human services agency, has agreed to a settlement to resolve class action litigation over a November 2024 cyberattack and data breach that affected 12,633 individuals.
Astrana Health Notifies SEC About Social Engineering Incident
Astrana Health, a managed services organization that helps healthcare providers deliver value-based, coordinated care to patients, has notified the U.S. Astrana Health, a managed services organization that helps healthcare providers deliver value-based, coordinated care to patients, has notified the U.S. Securities and Exchange Commission about a social engineering incident that exposed patient, employee, and provider information.
California Critical Access Hospital Announces Cybersecurity Incident
Data breaches have been announced by Modoc Medical Center and Vista Del Mar Child and Family Services in California, Park Place Behavioral Healthcare in Modoc Medical Center, a California critical access hospital, has announced a cybersecurity incident and data breach. Data breaches have also been announced by Vista Del Mar Child and Family Services in California, Park Place Behavioral Healthcare in Florida, and Millstone Medical Outsourcing in Massachusetts.
CVS Health; Criteo Agree to Pay $20.5 Million to Resolve Website Tracking Litigation
Settlements have been agreed to resolve class action litigation against CVS Health & Criteo and American Wellness Corp. The lawsuits stem from their CVS & Health and Criteo have agreed to pay $20.5 million to resolve class action litigation over the use of website tracking tools. American Wellness Corp. has agreed to pay $2 million to settle a similar class action complaint.
California Seeks to Implement AI Guardrails for Mental Health Treatment
A bill has been unanimously passed by the California Senate that seeks to establish common-sense guardrails for artificial intelligence (AI) use in mental A bill has been passed by the California legislature that sets common sense guardrails for Artificial intelligence in mental health treatment. The bill now awaits the signature of the state governor.
Albany College of Pharmacy and Health Sciences Data Breach Settlement
Albany College of Pharmacy and Health Sciences in New York State has agreed to settle a class action lawsuit stemming from a 2024 cybersecurity incident Albany College of Pharmacy and Health Sciences has agreed to settle a class action lawsuit related to a 2024 cybersecurity incident that affected 26,411 individuals.
Democratic Senators Reintroduce the Health Infrastructure Security and Accountability Act
On September 17, 2026, two Democratic Senators reintroduced the Health Infrastructure Security and Accountability Act, which seeks to improve A pair of Democratic Senators reintroduced the Health Infrastructure Security and Accountability Act, which seeks to increase healthcare cybersecurity standards. The bill calls for $1.3 billion in government investment to help healthcare organizations adopt the essential and enhanced HHS cybersecurity goals, including $800 million for rural and underserved hospitals.
House Subcommittee on Health Examines Healthcare Cybersecurity Proposals
On September 15, 2026, the United States House Energy and Commerce Committee Subcommittee on Health held a legislative hearing on proposals to improve On September 15, 2026, the United States House Energy and Commerce Committee Subcommittee on Health held a legislative hearing, which in part, considered proposed reforms to improve healthcare cybersecurity.
Nationwide Home Health Care Provider Announces Major Data Breach
Data breaches have been reported by the Louisiana-based home health service provider LHC Group, Provident Behavioral Health in Missouri, Elixir Medical Data breaches have been reported by the Louisiana-based home health service provider LHC Group, Provident Behavioral Health in Missouri, Elixir Medical Corporation in California, and Central Arkansas Pediatrics.
FTC Rescinds 2021 Policy Statement on Health App Data Breaches
In September 2021, the U.S. Federal Trade Commission (FTC) issued a policy statement extending the FTC Health Breach Notification Rule to cover health In 2021, the FTC issued a policy statement extending its Health Breach Notification Rule to cover health apps and other connected devices not covered by HIPAA. The policy statement was withdrawn in September 2026, as it was considered obsolete.
Luminis Health Working to Restore Systems After Cyberattack
Luminis Health in Maryland is investigating a cyberattack that has taken certain systems offline. Data breaches have been announced by Texas Orthopedic Luminis Health in Maryland is investigating a cyberattack that has taken certain systems offline. Data breaches have been announced by Texas Orthopedic surgeon Jeffrey David Reuben, M.D, Well Child in Tennessee, and Horizon Eye Care Laser & Eye Surgery Center in New Jersey.
June 2026 Healthcare Data Breach Report
In June 2026, 66 large healthcare data breaches – data breaches involving the protected health information of 500 or more individuals – were reported to In June 2026, 66 healthcare data breaches affecting 500 or more individuals were reported under HIPAA, and the protected health information of almost 4.5 million Americans was breached.
August Monthly Review: ChatGPT In Epic
Death, taxes, another frontier lab healthcare launch inspiring truly insane LinkedIn takes. As much as I want to stay away, I repeatedly am the crewman unplugging his ears whenever we pass these sirens. So it’s not the first and probably not the last time we dial up the typewriter rather than tie ourselves to the mast. The full blow-by-blow timeline: Health API Guy is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber. Subscribe The End of the Standalone PHR (Jan 8): ChatGPT Health arrives for consumers, at the time powered by b.well. I was bullish on the approach in that the best way for the PHR to finally solve distribution was to meet consumers were they already are (i.e. When Horizontal Meets Healthcare (Jan 9): OpenAI for Healthcare puts out the shingle for enterprises, with SharePoint ingestion standing in for the EHR integration the product actually needed. Another One: Anthropic’s Healthcare Debut (Jan 16): Claude's version, on HealthEx rails instead of b.well, with Agent Skills for FHIR development as the one true vertical-specific investment. ChatGPT for Clinicians: The Trap Sprung (Apr 24): OpenAI filled in the missing GTM middle with a free product for verified clinicians, effectively peeling the enterprise wrapper off ChatGPT for Healthcare and taking the PLG fight directly to OpenEvidence. OpenAI’s Second Attempt at Health (Jul 31): a relaunch of their patient specific app, now branded Health in ChatGPT, where the privacy partition came out, the connectors thinned, and b.well disappeared in favor of first-party FHIR work against a smaller network Beyond a Shingle So what was announced now? Today, we’re introducing a new electronic health record integration that brings authorized patient context from Epic into ChatGPT for Healthcare, along with the Healthcare Public Data plugin for direct, structured access to official healthcare datasets like PubMed, DailyMed, and CMS Coverage. Together, these capabilities bring ChatGPT closer to the systems and sources healthcare teams trust, while supporting the controls and compliance healthcare work requires. The core portfolio is unchanged from prior announcements we delineated and discussed (aside from the relaunch of patient-facing). Since trade publications still seem to be confusing them by using the wrong names: Enterprise sales motion: ChatGPT for Healthcare Protecting their core product / PLG: ChatGPT for Clinicians Consumer/patient-facing product: Health in ChatGPT So really, this is a feature release (specifically for ChatGPT for Healthcare when it comes to EHR integration). What’s cool about it, though, is that we are moving beyond just putting out a shingle. Everything in the January enterprise launch was horizontalizable: Horizontal tech companies thus generally start verticalization with their “putting out a shingle phase”. Telling the world you’re open for business as a horizontal tech company reliably attracts early inbound interest from buyers who are already trying to force-fit horizontal tools into domain-specific workflows and are eager for any signal that the vendor intends to support their use case more directly. Nothing was really vertical specific, which is exactly what you'd expect from the ultimate hypergrowth horizontal company dipping their toes into specific industries. But eventually you have to stop changing the sign on the door and start changing the product. Can you guess where the horizontal product was going to run out of road? This is the core dilemma writ large: verticalization requires differentiation, while scale economics of consumer and horizontal push toward unification. I’ve buried the lede so deep here it will be painful to some readers, but what should be shocking to no one is that my perspective is that EHR integration is the only path that meaningfully resolves this tension for ChatGPT for Healthcare. Integration with Microsoft Sharepoint is fine, but it is categorically insufficient for any product that hopes to influence clinical decision-making. SMART Money Well here we are, eight months later! Real vertical investment has begun, which surprised a few people. One friend in the industry messaged me: “Absolutely no way Epic gave ChatGPT API access.” Looking forensically at the announcements, the integration is notably read-only across appointment notes, laboratory results, medications, and specialist documentation. So while I’m not a betting man, I'd wager the house this is a SMART on FHIR launch: That sounds a lot like USCDI! The recommended path for the workflow they outline would be SMART on FHIR Their Health AI lead’s post is evocative of both standalone and EHR launch SMART, which another termed “ChartGPT” and “EHR Plugin” The implementation burden for SMART on FHIR is the lowest of the available integrative paths This is the team who literally did patient-facing SMART on FHIR with Epic last month Most importantly, if you’re a horizontal company, you generally still haven’t taken the full plunge and thus (overly) value reusability. SMART on FHIR is the logical compromise: healthcare-specific enough to matter, but standardized enough to reuse. Nobody Asked Judy Another friend asked “I thought they had to go to each health system, or did they go direct to Epic and now health systems opt in?” Given the trust paradigms in healthcare, this functionally cannot be Epic hoovering up all the data for OpenAI and shoving ChatGPT in their customers’ faces (or they would revolt). However, I do believe the aforementioned terrible coverage by TechCrunch and other outlets is probably responsible for that question, given the 325 million reference. When using FHIR as a business associate to an Epic customer, there is no EHR gatekeeping to speak of, as that isn’t how fhir.epic.com works: You register an app You pick your APIs You test against the sandbox APIs You list as “Ready for Production” Hospitals pick your app You test and go live with them Bluntly, nobody had to say yes or no in Verona (nor were they given the chance). Vendor Services (their next developer tier up that I doubt OpenAI is using quite yet in this initial release) certainly has contractual paperwork that some resent, but even there, the twin pressures of mounting antitrust and information blocking make outright gatekeeping increasingly fraught. My friend’s sentiment is, to me, representative of a broader industry neurosis, perhaps a sort of scar tissue of prior eras: people assume the gate is still there and never actually try the door. There are certainly other ways Epic (and any EHR) can put its thumb on the scale, but they are not so dumb as to stand in front of a federally mandated API and play bouncer at this exact moment in time. So I think they can and probably should go deeper, as this release is at best parity and at worst behind vertical-specific competition. OpenEvidence did a basic SMART launch with Sutter Health in February, allowing for more convenient evidence search by providers. They then add patient-context (the equivalent SMART on FHIR flow to what we see here) when Cedars-Sinai went enterprise-wide in May. UpToDate has four distinct applications across deeper workflows like patient engagement listed in Epic Showroom and announced a partnership with Epic to power Art at UGM Abridge and other ambient scribes have invested deeply into the deepest bidirectional clinical copilot workflow with integrations well beyond SMART on FHIR. In that light, the “Who is OpenAI primarily targeting here?” is clear. This release brings them into striking distance of OpenEvidence, but not the others quite yet. They are the only one of the three you can reach without building something truly Epic-specific. When will they go further? Competition is a great motivator to overcome the horizontal demons and start building things that can’t be reused: not across industries, not across EHRs, maybe not past the customer you built them for. That’s the price of actually verticalizing. The question is if and when OpenAI will be willing to pay it. Month in Review Here is the monthly review. As a reminder, this is a regular round-up of the month’s posts and other content to surface things you may have missed across regulation, litigation, interoperability, and beyond. AI assistance is used in these bullet summaries so I can focus on articles. Articles Published: None this month Video Content: The Information Exchange: Standards-based Thruple Edition (Aug 14): Back to school for us too, with Brad reporting in from the CMS Health Tech Ecosystem’s one year anniversary in DC. We get into the January CMS-0057 deadline, the fall rulemaking reading list, and why enrollment still keeps most apps off FHIR. The Information Exchange: Epic Dúnadan Edition (Aug 25): A UGM roundup with Ryan Brickner joining for the first time to check our takes against what the building actually thinks. Rangers, Ergo sitting on top of EHI, and a down-market lineup that needs some cuts. Regulatory: Stacked Deck, Bad Hand (Aug 05): ONC’s website refresh took the entire HIT Policy Committee record with it, so I rebuilt the archive and went looking for the regulatory capture story everyone assumes is buried in there. Stacking the deck and winning the hand turn out to be very different things. The Sixth Generation of Patient Access (Aug 19): A quick catalog of the five generations of patient access we’ve layered on since HIPAA, and the two candidates now competing to be the sixth. One is planned. The other is the market routing around the plan entirely. Court cases: Three Cases Walk Into a Docket (Aug 06): Two surprise settlements cleared the board in a single week, and then Judge Maddox dropped ninety-four pages on Vyne v. Henry Schein. The sleeper is a DMCA holding that makes direct-to-database a considerably riskier business model. Epic v. Health Gorilla: Into the MDL (Aug 10): Nine class actions are headed to Miami, and the Panel signaled it wants to bring the case that spawned them along too. That would leave Epic arguing the requests were obviously fraudulent in one courtroom and unknowable in the other. Amazon v. Perplexity: Agents Are Legalized! (Aug 11): The Ninth Circuit vacated the injunction against Comet, holding that the user is the one accessing the servers rather than the company that built the agent. A real win for agentic access, and a much narrower one than the headline suggests. Veeva v. Epic: Come At Me, Bro (Aug 26): Epic’s response brief wants the dismissal affirmed and, unusually, wants the opinion published as precedent. Buried in it is Epic’s own description of what its non-competes actually prohibit, which current and former employees should read closely. EHRs: The Contract Epic Would Never Sign Today (Aug 04): A 1999 SEC exhibit catches Epic licensing nearly its entire product line, Tapestry included, to the company that became TriZetto. The marketing services menu attached to it is the part that will make you blink. Forecast from Verona (Aug 07): The Epic Almanac makes one argument six different ways: the AI is only as good as the networks behind it. Emmie headlines, Art’s context stack is the most ambitious part, and Penny finally gets an autonomous coding date on the calendar. Works With Epic MyChart (Aug 17): Epic’s first new Showroom category since the death of Workshop certifies hardware instead of software, badge on the box and all. Made for iPhone, but for blood pressure cuffs, and rough news for anyone selling the RPM stack sitting in between. UGM Hot Takes 2026 (Aug 20): Everyone else covered the AI announcements, so I went after Savvy deleting the payment gateway, Rangers as Boost with the timer removed, and a down-market lineup with too many entries. Plus the Health Grid tidbits I cannot help myself on. MyChart Central Grows Up (Aug 24): Device data and Emmie turn Epic’s identity hub into a full consumer platform, which is both a logical answer to ChatGPT and a bit of a mistake. It also happens to be the best scraping target Epic has ever shipped. Industry Analysis: The Wrong Yardstick (Aug 12): Vertical software keeps getting judged against Superhuman and Notion, which is the wrong bar entirely. Your user is comparing your product to a whiteboard and forty phone calls before lunch. Primitives vs. Abstractions (Aug 27): Developers want building blocks, systems of record prefer to hand out business logic, and both sides have a real case. There’s no test from the outside that separates the engineering reason from the competitive one, which is why this keeps ending up in court. Cross-industry Comparisons: The Two Kinds of Platform Power (Aug 18): Attention power and record power are different problems that keep getting handed the same regulatory toolkit. Congress’s latest swing at Big Tech shows both what’s possible and where it falls apart. The Dogs of (Platform) War (Aug 21): A CourtListener alert turned up a property management fight with healthcare’s exact shape and none of the Cures Act. Shell prospects, ghost accounts, a notetaker bot that came back to haunt someone, and a lawyer arguing both sides of the same theory in two states. Fractals All the Way Down (Aug 31): Yardi dominates property management right up until you zoom into one segment, where AppFolio owns it outright and Yardi doesn’t appear at all. Where you draw the line around a B2B software market is about to decide an awful lot of cases. Other News: If Judy Had the Courage (Aug 13): A short eulogy for the era when software was allowed to look insane: WinAMP, bold colors, and everything the grey chatbot era has taken from us. External Media: Portland Monthly Health Tech Meetup: Erin O’Brien channeled my own feelings - maybe it’s just because it’s August and beautiful, but the monthly edition of the PDX Health community meetup was a ripper. Make sure to reach out if interested to join for the next one. STAT’s Coverage of Epic This Month: Brittany Trang of STAT did a fantastic job of breaking the FTC investigation that’s been lurking, as well as UGM related coverage, so I had to give her her wish of a meme. Fall Conferences: I’m pumped to be kicking off my fall conference season in NYC at Nabla Accelerate next month, which Chrissy provided the link to apply for. Here’s the rest of my schedule in case you want to meet up: Commonwell (Redwood Shores, CA): Oct 13-14 Open@Epic (Madison, WI): Oct 21-22 eHealthExchange (Austin, TX): Oct 27 Sequoia Project (Austin, TX): Oct 28-29 HLTH (Vegas): Nov 15-18 RSNA (Chicago): Nov 29-Dec 3 Posts I Liked: HTI-6 Should Unbundle API Certification: Josh Mandel makes the case that HTI-6 should split (g)(10) into separate authorization and data certifications, so a PACS or a genomics platform can certify only the role it actually performs. Imaging is the urgent example, but the structure solves a much bigger problem. On implementing ePrior Auth with Epic: Scott Rossignol’s field notes from a live ePrior Auth build on Epic, including the two app registrations nobody warns you about and the CPT mapping problem waiting at the end. CMS-0057 implementations are going to be such a beast. Healthcare point solutions are starting to look a lot like streaming services: Spencer Dorn runs the cable-to-streaming arc against health IT and lands squarely on the bundling half of the cycle. Bundling can be good! It can also be bad! Life is nuanced. Health API Guy is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber. Subscribe
Hundreds gather in Tuscaloosa for statewide behavioral health conference
Organizers said more than 500 people attended the conference either in person or online.
Aesto Health Data Security Incident Affects Multiple Healthcare Provider Clients
A data breach at Aesto Health, a Birmingham, Alabama-based healthcare technology company, has affected several of its healthcare provider clients. Aesto A security incident at the Alabama healthcare technology company Aesto Health has affected at least 27 of its healthcare provider clients and exposed the protected health information of hundreds of thousands of patients.
Highland Health Systems; Albany Gastroenterology Consultants Settle Data Breach Lawsuits
Settlements have received preliminary approval to resolve class action data breach complaints against Highland Health Systems and Albany Gastroenterology Settlements have received preliminary approval to resolve class action data breach complaints against Albany Gastroenterology Consultants and Highland Health Systems stemming from breaches of patient data.
Health Privacy Legislation Advances in the Senate
CDT supports stronger privacy protections for consumer health data that falls outside of HIPAA. We’ve consistently called for privacy protections that move away from outdated notice and consent regimes and instead embrace limitations around corporate data practices that limit data collection, retention, sharing, and use of data that is necessary for the products and services […]
Banner Health; LifeStance Health Group Settle Tracking Technology Lawsuits
Two healthcare providers have agreed to settle lawsuits over their use of pixels and other website tracking technologies. The tools allegedly resulted in Banner Health and LifeStance Health Group were sued over their use of pixels and other website tracking technologies, which were alleged to have resulted in impermissible disclosures of patient data to third parties. Settlements have been agreed to resolve the litigation.
Business Associates Face Increased Regulatory Scrutiny as Vendor Breaches Soar
The healthcare industry has the highest rate of third-party data breaches out of any sector, according to the Verizon Data Breach Investigations Report In 2017, 13% of healthcare data breaches involved healthcare vendors. Fast forward to H1 2026, and that percentage has risen to 43%. With data breaches soaring, vendors are facing increased regulatory scrutiny, and new cybersecurity requirements are due for imminent release.
HHS Restructuring and New Enforcement Signal Increased Focus on Privacy, Security, and Health Plans
On May 18, 2026, the U.S. Department of Health and Human Services (HHS) announced the restructuring of its Office for Civil Rights (OCR) enforcement efforts, establishing a dedicated unit for privacy and security enforcement under the Health Insurance Portability and Accountability Act (HIPAA). The move, combined with a recent enforcement action over a ransomware attack, highlights the agency’s new enforcement focus on health plans and the employers that sponsor them.
The Impact of Proposed Changes to the HIPAA Security Rule for Business Associates
A final rule updating the HIPAA Security Rule is due for release as early as May 2026. According to HHS/OCR, the modifications to the Security Rule will The final rule implementing changes to the HIPAA Security Rule is due in May 2026. The final rule will have major implications for business associates of HIPAA-covered entities.
Esse Health Agrees to Pay 2.53M to Settle Data Breach Lawsuit
American Multispecialty Group, doing business as Esse Health, a Missouri-based independent physician group serving the greater St. Louis area, experienced Esse Health has agreed to pay $2,525,000 to settle class action litigation stemming from an April 2025 data breach that affected more than 521,000 individuals.
Atrium Health & Interim HealthCare Affected by Business Associate Data Breaches
Atrium Health Navicent and Interim HealthCare of Lubbock/Amarillo have recently announced that they have been affected by data breaches at third-party Atrium Health Navicent and Interim HealthCare of Lubbock/Amarillo have recently announced that they have been affected by data breaches at third party vendors.
Ransomware Attack on Good Samaritan Health Center Affects 10,000 Individuals
Data breaches have recently been announced by Green Imaging, Good Samaritan Health Center, Wonderland Child & Family Services, and L.A. Care Health Data breaches have recently been announced by Good Samaritan Health Center, Wonderland Child & Family Services, and L.A. Care Health Plan.
Data Breaches Announced by Mindpath Health; Springfield Hospital; Lone Peak Psychiatry
Data breaches have been announced by the California psychiatry and therapy provider Mindpath Health, Springfield Hospital in Vermont, and Lone Peak Data breaches have been announced by the California psychiatry and therapy provider Mindpath Health, Springfield Hospital in Vermont, and Lone Peak Psychiatry in Utah.
CMS Launches First Wave of Health Tech Ecosystem Health Information Sharing and Access Tools
The Department of Health and Human Services (HHS) Centers for Medicare and Medicaid Services (CMS) has launched the first wave of Health Tech Ecosystem The CMS has launched the first wave of Health Tech Ecosystem tools under its initiative to improve interoperability and patient access to their own health information.
Data Breaches Announced by DermCare Management; Option Care Health; Aetna
Data breaches have recently been announced by DermCare Management in Florida, Option Care Health in New York, and Aetna in Connecticut. DermCare Data breaches have recently been announced by DermCare Management in Florida, Option Care Health in New York, and Aetna in Connecticut.
Data Breaches Announced by Corewell Health & Rocky Mountain Care
Rocky Mountain Care in Utah has announced a January 2026 data breach, and Corewell Health in Michigan has confirmed that more than 19,000 patients have Rocky Mountain Care in Utah has announced a January 2026 data breach, and Corewell Health in Michigan has confirmed that more than 19,000 patients have been affected by a data breach at business associate Pinnacle Holdings.
When health data lives everywhere: Rethinking privacy outside the EHR
Health privacy risks now extend far beyond medical records governed by HIPAA.
Anthropic Adds Features for Doctors, Patients in Health Care Push
Anthropic is making it easier for patients and clinicians to use its artificial intelligence chatbot to access medical information, part of a broader push into the lucrative health care sector. The San Francisco-based company on Sunday said that its Claude product is launching a new health care offering that is compliant with the Health Insurance Portability and Accountability Act, or HIPAA, and can be used by hospitals, medical providers and consumers to field protected health data. Anthropic h
Advancing Claude in healthcare and the life sciences
Introducing Claude for Healthcare with HIPAA-ready infrastructure, plus expanded Life Sciences tools for clinical trials and regulatory submissions. New connectors to CMS, Medidata, and ClinicalTrials.gov.
Advancing Claude in healthcare and the life sciences
Introducing Claude for Healthcare with HIPAA-ready infrastructure, plus expanded Life Sciences tools for clinical trials and regulatory submissions. New connectors to CMS, Medidata, and ClinicalTrials.gov.
WellSpan Health Announces Comprehensive Migration of Technology Portfolio to AWS
Add to FavoritesWellSpan Health, the leading health care system serving Central Pennsylvania and Northern Maryland, today announced plans for a comprehensive cloud migration of its full technology infrastructure. Together with Amazon Web Services (AWS) as its preferred cloud provider, WellSpan will transition its applications, data and environments from traditional data centers to AWS. This migration will establish the foundation for delivering next-generation, AI-enabled health care solutions that reduce administrative burden and improve outcomes for patients across the region and beyond. Supercharging Innovation, Efficiency and Patient Outcomes WellSpan's migration of systems and clinical applications, which serve 1.2 million patients across nine hospitals and 250+ facilities, is expected to be complete by April 2026, one of the fastest full-scale migrations in the health care industry. This transformation enables WellSpan to unify disparate data systems for care teams and patients alike, achieving operational efficiencies and care improvements that fragmented systems are unable to deliver. “Our comprehensive migration to the cloud accelerates our ability to deploy new clinical capabilities that transform patient care while advancing our overall innovation strategy,” said Roxanna Gapstur, Ph.D., R.N., president and CEO, WellSpan Health. “When a physician can access complete patient imaging in seconds instead of hours, we're not just modernizing technology—we're improving patient outcomes. Our new cloud infrastructure also enables us to quickly implement solutions that will free our clinicians from thousands of hours of administrative work annually so they can focus on what they do best: caring for our communities.” The transition allows WellSpan to move away from a data center-based model and enables the rapid deployment and scale of AI technology. WellSpan’s strategic partner, General Catalyst’s Health Assurance Transformation Company (HATCo), facilitated the collaboration with AWS to support the migration. WellSpan’s transformation journey benefits from HATCo’s specialized technology solutions, as well as General Catalyst and AWS’s significant partnership to improve patient outcomes, which was announced in January 2025. “Our decision to go all-in on AWS will enable insights and innovations impossible in traditional siloed environments,” said Kasey Paulus, executive vice president and chief operating officer, WellSpan Health. “This is the largest health care technology transformation in our region's history, and it positions WellSpan to be a premier partner for technology leaders across the country.” “WellSpan is building a foundation with AWS that will improve care and outcomes for patients across their health system by bringing data together into standardized formats that are optimized for AI applications,” said Dan Sheeran, vice president and general manager, Healthcare and Life Science, AWS. “To do this, it is essential to have the most secure and compliant cloud when handling patient data, along with AWS’s built-in AI governance and responsible AI frameworks that follow the industry’s highest standards to protect patient information. We look forward to continuing to work alongside WellSpan as they unlock the cloud and AI’s full potential to deliver exceptional care to their patients.” Key Benefits of the AWS Collaboration Full Portfolio Migration: WellSpan will transition its applications and data from on-premises data centers to AWS, including full IT environments and specialized applications for functions such as nursing, cardiology, pharmacy and the company’s supply chain systems. This represents approximately 7.5 petabytes of clinical and non-clinical data and more than 300 applications—the most comprehensive health system cloud migration in the Mid-Atlantic region. Approved Architectures: AWS will deliver secure, WellSpan-specific architectures tailored to each build, ensuring compliance and reliability across the health system. Unified, AI-Ready Data: Migrating to AWS enables WellSpan to harmonize data across separate systems, transforming unstructured clinical notes and multi-modal datasets into standardized, AI-ready formats. Accelerated Results and Improved Outcomes: Automated data normalization and processing will enable the deployment of applications that reduce turnaround times for items such as analyzing medical imaging or patient records from days to minutes, helping clinicians get patient results faster and improving overall health outcomes. Reduced Administrative Burden: The transition to AWS will enable swift deployment of AI-powered solutions that reclaim thousands of hours for WellSpan’s clinical and corporate teams, allowing them to focus on patient care rather than paperwork. Elastic Infrastructure: Cloud architecture will enable WellSpan to scale computing resources dynamically, supporting seasonal demand fluctuations without infrastructure investments, as well as the rapid deployment of new services across multiple locations simultaneously. Most Secure, Compliant Cloud: AWS offers the highest network availability of any cloud provider, with more than 166 HIPAA-eligible services and certifications for global compliance standards, including HITRUST CSF. Built-in AI governance and responsible AI frameworks ensure that WellSpan’s data is protected under the industry’s most rigorous standards. Tags:News releaseInnovation and partnerships
Data Breaches Confirmed by Revere Health & Health Management Systems of America
Revere Health in Utah and Health & Health Management Systems of America in Michigan have recently confirmed that they have experienced cyberattacks in Revere Health in Utah and Health & Health Management Systems of America in Michigan have recently confirmed that they have experienced cyberattacks in which patient data was exposed.
$3.5 Million Mindpath Health Data Breach Settlement Gets First Nod
A California Superior Court judge has given preliminary approval to a settlement to resolve litigation against Community Psychiatry Management, LLC, Mindpath Health has agreed to pay $3.5 million to settle a class action lawsuit stemming from a 2022 breach of its Microsoft Office email environment that exposed the protected health information of almost 194,000 individuals.