Sonic Healthcare U.S.A., Clinical Pathology Laboratories, Inc., Aurora Diagnostics LLC, and Austin Pathology Associates have agreed to a $6,438,578.20 settlement to resolve claims associated with…
On September 17, 2026, Sens. Mark R. Warner (D-VA) and Ron Wyden (D-OR) reintroduced the Health Infrastructure Security and Accountability Act suggesting obligatory cybersecurity criteria…
Strict data handling rules have been established for the stolen Change Healthcare dataset used as discovery material in consolidated litigation against United Health Group (UHG),…
Marlboro-Chesterfield Pathology, P.C. based in Pinehurst, North Carolina decided to resolve a class action lawsuit that was filed after the January 2025 ransomware attack that…
FMC Services, LLC, doing business as Family Medicine Centers in Texas, has agreed to a $2,150,000 settlement to resolve litigation connected to a July 2022…
The Federal Trade Commission and Idaho-based data broker Kochava and its subsidiary Collective Data Solutions have reached a settlement to resolve litigation concerning the sale…
Stryker has recovered the systems affected by the cyberattack last March 11 and its manufacturing network is now fully operational. Incident Overview When Stryker reported…
Holmes Regional Medical Center in Melbourne, Florida entered into a $113,407 settlement agreement with the Department of Health and Human Services Office of Inspector General…
The Federal Bureau of Investigation has issued Operation Winter SHIELD guidance identifying ten actions that organizations can take to improve cyber resilience. Overview Of Operation…
Falcon Healthcare, also known as Interim Healthcare of Lubbock, Texas provides home care and home health care services. The HIPAA-covered entity decided to settle class…
The pharmaceutical research firm Inotiv, based in West Lafayette, Indiana, recently announced a ransomware attack and data breach that resulted in the extraction of sensitive…
The healthcare company, CarePro Health Services, based in Iowa, decided to settle a class action litigation for $1.3 million. The lawsuit is associated with a…
Penetration testing conducted on ten State Medicaid Management Information Systems (MMIS) and Eligibility & Enrollment (E&E) systems has revealed vulnerabilities that could potentially be exploited…
23andMe agreed to settle a class action lawsuit related to a 2023 breach of customer information. The breach happened in October 2023 and involved the…
Providence Sacred Heart Medical Center & Children’s Hospital, located in Spokane, Washington, terminated fifteen nurses because of HIPAA violations. Allegedly, the nurses viewed a 12-year-old…
In case of violation of Health and Human Services (HHS) regulations by individuals or entities (this includes HIPAA-covered entities), HHS could decide to create a…
A registered practical nurse posted a med pass on TikTok and was terminated from work, and is now dealing with a Board of Nursing investigation…
The National Institute of Standards and Technology (NIST) has published a draft update on its Privacy Framework to include the most recent cybersecurity rules and…
Officers at Hamilton County in Tennessee have stated that the protected health information (PHI) of 14,081 people was exposed in a security incident at a…
Infosys McCamish Systems agreed to settle multiple class action lawsuits that were filed because of a 2023 ransomware attack. The data breach involved unauthorized access…
In December 2024, the Department of Health and Human Services released a Federal Register final rule changing the Retail Pharmacy Standards of the National Council…
Ivanti has issued patches for two vulnerabilities found in Connect Secure. The first vulnerability is a critical zero-day remote code execution vulnerability that threat actors…
The Health Sector Cybersecurity Coordination Center (HC3) published a new Analyst Note regarding credential harvesting, including an alert concerning an active credential harvesting campaign that…
The White House Office of Information and Regulatory Affairs is doing one last review of a proposed rule by the Occupational Safety and Health Administration…
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has reached a $250,000 settlement with Cascade Eye and Skin Centers, P.C.,…
A $2.95 million financial penalty payment is proposed by the Federal Trade Commission (FTC) for Verkada, a security camera vendor based in California, to settle…
According to information provided by the Vipre Security Group, there’s a spike in business email compromise attacks in the previous year and cybercriminals are using…
The healthcare industry is facing more severe and sophisticated cyberattacks. Greater effort is necessary to strengthen protection, attacks will likely keep increasing. These attacks present…
Blackbaud has decided to pay $6.75 million to resolve alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and California’s data privacy regulations…
858K Individuals Impacted by Superior Air-Ground Ambulance Service Data Breach Superior Air-Ground Ambulance Service provides ambulance and Emergency Medical Services (EMS) in Indiana, Illinois, Michigan,…
Administration services provider to medical insurance and benefit plans, WebTPA based in Texas, recently began sending notification letters to 2,429,175 benefit plan members concerning the…
Investigation Of Ascension Cyberattack Ascension, a leading non-profit and Catholic health system in the U.S., has reported the investigation of a supposed cyberattack that has…
Wisconsin Dental Surgery Center Email Account Breach Bay Oral Surgery & Implant Center (Bay Oral), a group of oral & maxillofacial dental surgery centers located…
OctaPharma Plasma Donation Centers Shut Down While Investigating Ransomware Attack The Swiss pharmaceutical company, Octapharma Plasma, encountered a cyberattack that impacted the systems at 190…
Epic Systems has shut down access to information for a startup company called Particle Health after it alleged that the company was disclosing patient information…
The term HIPAA compliant email refers to an email system with the necessary safeguards to protect the confidentiality, integrity, and availability of PHI, that is…
Over 547,000 People Impacted by The Chattanooga Heart Institute Cyberattack on April 2023 The Chattanooga Heart Institute has found out that its April 2023 cyberattack…
Aveanna Healthcare Email Account Breach Home health and hospice care provider, Aveanna Healthcare based in Atlanta, GA, announced a security breach of its email environment…
HIPAA was enacted to improve the efficiency and effectiveness of the healthcare system by ensuring the portability of health insurance coverage, protecting the privacy and…
Credential Harvesting Mitigations Shared by HHS The Health Sector Cybersecurity Coordination Center (HC3) has published a healthcare and public health (HPH) sector advisory concerning credential…
HIPAA does not apply to entities or individuals that do not meet the definition of covered entities or business associates under the HIPAA regulations, such…
The purpose of the HIPAA Privacy Rule is to establish national standards for the protection of individuals’ medical records and other personal health information, ensuring…
An example of protected health information (PHI) is a patient’s medical record containing personal identifiers such as their name, date of birth, Social Security number,…
State privacy law supersedes HIPAA when it provides greater privacy protections or rights to individuals regarding the use and disclosure of protected health information (PHI),…
Data Breach at Weirton Medical Center in West Virginia Weirton Medical Center based in West Virginia discovered suspicious activity inside its computer system on January…
The consequences of violating HIPAA can include civil monetary penalties, corrective action plans, criminal charges, reputational damage, and disciplinary actions, potentially leading to fines, imprisonment,…
HIPAA benefits patients by ensuring the confidentiality, security, and privacy of their protected health information (PHI), granting them greater control over their medical records, building…
HSCC’s 5-Year Strategic Program for Strengthening Healthcare Cybersecurity Healthcare cyberattacks are increasing in number and intensity every year. In 2023, around 740 healthcare data breach…
A healthcare clearinghouse serves as an important intermediary in the exchange of electronic health information within the healthcare system. Acting as a centralized hub, a…
177,000 Patients Affected by Northeast Orthopedics and Sports Medicine Breach Northeast Orthopedics and Sports Medicine located in Nanuet, NY recently announced a cyberattack that affected…
A HIPAA violation involves a range of infractions that breach the regulations stipulated by HIPAA regarding the safeguarding of protected health information (PHI). This includes…
HIPAA was enacted in 1996, marking an important milestone in healthcare regulation within the United States. This legislation was introduced with the goal of addressing…
Apria Healthcare Faces Lawsuit Over HIPAA Violations Indiana Attorney General Todd Rokita is taking legal action against Apria Healthcare for violating the Health Insurance Portability…
A HIPAA violation in the workplace constitutes a breach of the regulatory standards outlined in the HIPAA, specifically concerning the protection of protected health information…
The HIPAA Privacy Rule represents a foundational component of healthcare regulation in the United States, setting in-depth standards for safeguarding individuals’ protected health information (PHI)….
Vulnerabilities identified in the remote desktop software ConnectWise ScreenConnect are being exploited to deliver a selection of different malicious payloads into enterprise environments. ConnectWise first…
The purpose of HIPAA involves several key objectives aimed at improving the healthcare system. HIPAA seeks to safeguard the privacy and security of individuals’ protected…
The Department of Health and Human Services (HHS) Office for Civil Rights has filed its annual report to Congress about compliance with the HIPAA Privacy,…
A covered entity under HIPAA includes healthcare providers, health plans, and healthcare clearinghouses that engage in electronic transactions involving individually identifiable health information. Healthcare providers…
Protected Health Information (PHI) comprises any individually identifiable health information that is maintained or transmitted by covered entities. This involves a wide range of data,…
Protected Health Information (PHI) involves a broad range of individually identifiable health data maintained or transmitted in any form or medium, inclusive of but not…
U.S. Senator Ron Wyden (D-OR) wrote to the Federal Trade Commission (FTC) and the Securities and Exchange Commission (SEC) requiring action to safeguard customers and…
The Government Accountability Office (GAO) has discovered that many federal agencies that deal with risk for critical infrastructure sectors have evaluated or intend to monitor…
462,000 Hawaiians Impacted by the Navvis & Company Data Breach Around 462,000 people who signed up for health plans with the Hawaii Medical Service Association…
It is possible to report a HIPAA violation anonymously by submitting a complaint to the Department of Health and Human Services’ Office for Civil Rights…
133K Records Exposed at Columbus Regional Healthcare System Columbus Regional Healthcare System in Whiteville, NC, submitted a report to the Maine Attorney General concerning a…
HMG Healthcare Data Breach Impacts 80,000 People Healthcare services provider HMG Healthcare, LLC based in Texas recently reported the exposure and potential theft of the…
As of January 2022, OneDrive, Microsoft’s cloud storage service, does not possess a dedicated HIPAA compliance certification, Microsoft does offer a HIPAA Business Associate Agreement…
Google Chat does not meet the standards for HIPAA compliance due to its lack of specific security features and assurances required to safeguard protected health…
Slack has the capability to meet the requirements for HIPAA compliance when configured with the appropriate security protocols and safeguards. To achieve HIPAA compliance, organizations…
Though the new HIPAA regulations presented in the Final Omnibus Rule of 2013 didn’t change much of the current HIPAA Security and Privacy Rules, there…
Azure offers services and features that can be used in a HIPAA-compliant manner, but achieving compliance requires proper configuration, implementation of appropriate security measures, and…
While HIPAA regulations do not specify an exact frequency for ongoing security and privacy training after the initial session, industry best practice is to conduct…
The enforcement of the Administrative Simplification requirements falls under the jurisdiction of the Office for Civil Rights (OCR) within the U.S. Department of Health and…
HIPAA mandates strict requirements for the protection of electronic protected health information (ePHI) through strong encryption measures. Covered entities and their business associates must implement…
Nurses who violate HIPAA may face strict penalties, involving both civil and criminal consequences, outlining the importance of upholding patient confidentiality and safeguarding protected health…
HIPAA was enacted with the primary aim of addressing several important aspects within the healthcare sector. Its introduction sought to improve the efficiency and efficacy…
After an accidental HIPAA violation occurs, the responsible party typically undergoes a thorough investigation by the Office for Civil Rights (OCR), the federal agency tasked…
Integris Health is facing some class action lawsuits because of a recent cyberattack that resulted in a data breach. Although there’s no confirmation yet from…
Under HIPAA, the distribution of patient information on social media platforms is strictly prohibited. HIPAA establishes strict confidentiality and privacy safeguards for individually identifiable health…
HIPAA outlines specific rules for the retention of records in the healthcare sector. Covered entities, including healthcare providers, health plans, and healthcare clearinghouses, are mandated…
HIPAA sets in-depth guidelines to safeguard electronic protected health information (ePHI) and requires covered entities and business associates to implement robust security measures, including secure…
HIPAA outlines strict guidelines to safeguard the confidentiality and security of protected health information (PHI), and violations of these provisions can manifest in various forms….
PHI of a deceased individual is safeguarded for a period of 50 years following their death, after which the information is no longer considered PHI…
The consequences for breaching HIPAA regulations are varied and carry strict legal and financial ramifications. Civil penalties for non-compliance can result in monetary fines levied…
In compliance with the HIPAA, healthcare providers must adhere to specific rules when telephoning patients to ensure the confidentiality and security of patients’ protected health…
A HIPAA Compliance Officer plays an important role within an organization by orchestrating the development and execution of policies and procedures aimed at achieving and…
ProSmile Holdings Patients Affected by July 2022 Data Breach Dental service organization ProSmile Holdings, LLC in New Jersey, notified patients on December 22, 2023, regarding…
While Google Drive, as a standalone service, does not inherently adhere to HIPAA standards, Google offers a Business Associate Agreement (BAA) for its Google Workspace…
The act of texting is not prohibited by HIPAA, but the transmission of protected health information (PHI) via unsecured text messaging platforms without appropriate safeguards…
Zoom can be utilized in a manner compliant with HIPAA when specific precautions are taken. Healthcare providers seeking to use Zoom for telehealth sessions or…
Healthcare entities and their business associates are mandated under HIPAA to promptly report any breaches of protected health information (PHI) to maintain compliance with federal…
The responsibility for enforcing HIPAA lies with the Office for Civil Rights (OCR), an entity operating within the U.S. Department of Health and Human Services…
About 6 lawsuits were filed against the Fred Hutchinson Cancer Center because of a cyberattack and data breach that happened on the Thanksgiving weekend of…
Reporting a HIPAA breach necessitates adhering to strict guidelines outlined in the HIPAA regulations. Upon discovering a breach, individuals or organizations are obligated to promptly…
Non-compliance with HIPAA can result in a range of penalties, both civil and criminal, reflecting the gravity of the HIPAA violation. Civil fines for HIPAA…
As of January 2022, Skype does not inherently meet the requirements for full compliance with the HIPAA. HIPAA mandates strict privacy and security standards for…
For HIPAA compliance, a dentist office must implement administrative, physical, and technical safeguards to protect patient health information, such as conducting regular risk assessments, training…
Under HIPAA, emailing patient names is permitted, provided that strict measures are in place to safeguard the confidentiality and security of protected health information (PHI)….
HIPAA certification, as a formal designation, does not exist within HIPAA. Despite this, ensuring compliance with HIPAA regulations is necessary for entities handling protected health…