Daily AI-analyzed compliance news covering HIPAA breaches, GDPR fines, PCI DSS updates, SOC 2 changes, and regulatory developments across every major framework.
Mindpath Health, Springfield Hospital, and Lone Peak Psychiatry have announced separate data breaches compromising patient protected health information (PHI). These incidents highlight ongoing cybersecurity challenges in healthcare and trigger mandatory HIPAA breach notification requirements for affected organizations.
Chattanooga Heart Institute has agreed to pay $3.75 million to resolve a class-action lawsuit stemming from a significant data breach that exposed protected health information. The settlement highlights the substantial financial consequences healthcare organizations face when HIPAA compliance failures lead to patient data exposure.
Plastic surgeons who post patient photos without proper authorization face serious HIPAA violations and potential legal consequences. Patients have specific rights regarding their medical images, and healthcare providers must obtain explicit written consent before using photos for marketing or educational purposes.
PCI Pal has achieved HIPAA, HITRUST, and SOC 2 Type II compliance certifications as part of its strategic expansion into the US enterprise market. These certifications position the company to serve healthcare organizations and other regulated industries requiring stringent data protection standards.
Cybercrime losses in 2025 exceeded $20 billion according to The HIPAA Journal, with healthcare organizations among the most targeted sectors. Healthcare entities face heightened risks of HIPAA violations and must strengthen cybersecurity measures to protect protected health information (PHI) from increasingly sophisticated attacks.
Signature Healthcare is experiencing a cyberattack that has forced ambulance diversions from Brockton Hospital, disrupting critical emergency services. The incident highlights vulnerabilities in healthcare IT systems and potential HIPAA compliance implications as the organization works to restore normal operations.
A healthcare software company has announced a significant security breach of its electronic health record (EHR) environment, potentially exposing protected health information (PHI) of numerous patients. The incident highlights critical vulnerabilities in healthcare IT infrastructure and triggers mandatory HIPAA breach notification requirements for affected covered entities and business associates.
A lawsuit has been filed to block the outsourcing of Consumer Directed Personal Assistance Program (CDPAP) services, citing potential HIPAA violations and patient privacy concerns. The legal challenge raises critical questions about healthcare data protection when outsourcing sensitive patient care services to third-party vendors.
Six healthcare organizations have recently reported data breaches involving protected health information to federal authorities, highlighting ongoing cybersecurity challenges in the healthcare sector. These incidents underscore the critical importance of robust data protection measures and HIPAA compliance in healthcare organizations.
Excelsior Orthopaedics and Buffalo Surgery Center have agreed to pay $2.4 million to settle a class-action lawsuit stemming from a significant data breach. The settlement addresses claims related to HIPAA violations and inadequate protection of patient health information.
The National Labor Relations Board issued a split decision supporting a hospital's termination of a union leader, marking a significant ruling in healthcare labor relations. The case establishes important precedent for how hospitals can address union leadership conduct while maintaining compliance with federal labor laws and healthcare regulations.
Deaconess Health System has disclosed that patient health information was compromised through a third-party vendor data breach. The incident highlights critical HIPAA compliance challenges when healthcare organizations rely on external service providers for data processing and storage.
OpenLoop Health, a telehealth platform provider, has disclosed a data breach potentially exposing protected health information (PHI) of patients. The incident represents another significant HIPAA security breach in the healthcare technology sector, highlighting ongoing cybersecurity challenges facing telehealth providers.
The Centers for Medicare & Medicaid Services (CMS) has released a final rule establishing HIPAA standards for health care claims attachments, affecting healthcare providers, payers, and clearinghouses. This rule standardizes the electronic submission of supporting documentation for medical claims, requiring covered entities to implement new technical and administrative safeguards for protected health information in claims processing.
The HIPAA Journal is hosting a free webinar titled 'HIPAA Email Security 101' focusing on Protected Health Information (PHI) handling, encryption requirements, and compliance obligations for healthcare organizations. The educational session addresses critical email security practices required under HIPAA regulations.
An Iran-linked hacking group successfully infiltrated and wiped data from a U.S. medical device manufacturer, raising serious HIPAA compliance concerns for the healthcare industry. The cyberattack demonstrates the growing threat posed by nation-state actors targeting healthcare infrastructure and protected health information (PHI).
The U.S. Senate has advanced bipartisan legislation aimed at strengthening cybersecurity requirements for healthcare organizations. The reform bill addresses vulnerabilities in medical data protection and aims to enhance HIPAA compliance standards across the healthcare sector.
The Trump administration has announced a comprehensive cybersecurity strategy that will significantly impact healthcare organizations' HIPAA compliance requirements. The new initiative focuses on strengthening critical infrastructure protection, including healthcare systems that handle sensitive patient data. Healthcare entities will need to reassess their cybersecurity frameworks to align with enhanced federal requirements.
Mindbowser Inc., a technology consulting firm, has successfully obtained SOC 2 Type II certification, demonstrating enhanced security controls for healthcare data protection. This certification strengthens the company's ability to serve enterprise healthcare clients with compliant data handling practices and robust security frameworks.
A pharmacy customer reported witnessing a technician's behavior that appeared to violate HIPAA privacy requirements, raising concerns about patient information protection in retail pharmacy settings. The incident highlights ongoing challenges healthcare providers face in maintaining staff compliance with federal privacy regulations.
A business associate has reached a settlement with federal regulators over HIPAA violations related to an unreported data breach that affected 15 million individuals. The case highlights critical compliance failures in breach notification requirements and the severe consequences of delayed reporting to covered entities and regulators.
Excel Healthcare is facing a class action lawsuit investigation following a data breach that potentially exposed patient protected health information. The incident highlights ongoing HIPAA compliance challenges in healthcare organizations and may result in significant financial penalties for affected patients.
Pinnacle Holdings is under investigation for a significant data breach that has triggered a lawsuit probe by Claim Depot. The breach potentially affects sensitive personal and healthcare information, raising serious HIPAA compliance questions for the organization and its data handling practices.
Indiana University Health has filed a lawsuit against a healthcare technology company in connection with a significant data breach that occurred in 2024. The legal action highlights ongoing concerns about third-party vendor security and HIPAA compliance in healthcare organizations, potentially affecting thousands of patients' protected health information.
The College of Health Care Professions is under investigation for a potential data breach that may have exposed protected health information of students and patients. The incident has prompted a class-action lawsuit investigation, highlighting critical HIPAA compliance concerns for educational healthcare institutions.
The January 2026 Healthcare Data Breach Report from The HIPAA Journal documents significant protected health information (PHI) breaches affecting healthcare organizations nationwide. Multiple incidents involved unauthorized access to patient records, highlighting ongoing challenges in healthcare cybersecurity and HIPAA compliance implementation.
Rebound Orthopedics & Neurosurgery agreed to pay $2.5 million to settle a class-action lawsuit following a significant data breach that compromised patient health information. The settlement highlights the ongoing financial and legal risks healthcare organizations face when HIPAA-protected data is compromised, emphasizing the critical importance of robust cybersecurity measures in medical practices.
Carolina Foot & Ankle Associates has notified patients about a cyberattack that occurred in December 2025, potentially compromising protected health information. The healthcare provider is working with cybersecurity experts and law enforcement to investigate the incident and implement additional security measures.
New healthcare data breach statistics show concerning trends in patient data security vulnerabilities across the industry. The analysis reveals key patterns in breach types, affected entities, and compliance failures that healthcare organizations must address to maintain HIPAA compliance.
Evergreen Healthcare Group is under investigation for a data breach that has prompted class-action lawsuit proceedings. The breach potentially exposed protected health information (PHI) of patients, raising significant HIPAA compliance concerns and highlighting vulnerabilities in healthcare data security systems.
QualDerm Partners, a dermatology practice management company, has confirmed a significant data breach compromising patient protected health information (PHI). The incident highlights ongoing cybersecurity vulnerabilities in healthcare organizations and potential HIPAA compliance violations that could result in substantial regulatory penalties.
Norton Healthcare has agreed to pay $11 million in a class action settlement following a significant HIPAA data breach that exposed patient protected health information. The settlement addresses violations of federal healthcare privacy regulations and provides compensation for affected patients whose sensitive medical data was compromised.
Norton has reached a settlement agreement in the lawsuit stemming from its 2023 data breach that exposed personal information of millions of users. The settlement addresses claims related to inadequate cybersecurity protections and provides compensation for affected consumers while establishing new security requirements for the company.
Norton Healthcare's data breach settlement is moving toward final court approval, marking a significant milestone in the healthcare organization's response to a major security incident. The settlement addresses HIPAA compliance violations and provides compensation for affected patients whose protected health information was compromised.
Norton Healthcare has reached a settlement agreement in a lawsuit stemming from a significant data breach that exposed patient protected health information. The settlement resolves claims related to the healthcare system's alleged failure to adequately protect patient data under HIPAA requirements.
Norton Healthcare has reached a settlement agreement following a data breach that compromised patient health information. The settlement highlights critical HIPAA compliance requirements for healthcare organizations and demonstrates the financial consequences of inadequate data protection measures.
Norton Healthcare has reached a settlement agreement for its 2023 data breach lawsuit that compromised patient health information. The settlement provides compensation for affected patients whose protected health information was exposed, highlighting the ongoing costs of HIPAA violations for healthcare organizations.
Norton Healthcare has reached a settlement agreement for victims of its data breach, with compensation amounts varying based on the type of information compromised and damages incurred. The settlement addresses HIPAA violations and provides financial relief for affected patients whose protected health information was exposed.
Healthcare organizations developing mobile applications in 2026 must navigate updated HIPAA compliance requirements that address modern security threats and emerging technologies. The comprehensive guide outlines mandatory security controls, encryption standards, and implementation strategies for protecting patient health information in mobile environments.
An Iowa-based healthcare company is facing a significant lawsuit after experiencing a massive cyberattack that compromised sensitive health data. The breach has raised serious questions about HIPAA compliance and cybersecurity measures in healthcare organizations, potentially affecting thousands of patients whose protected health information may have been exposed.
The Office for Civil Rights (OCR) has initiated its Part 2 Compliance Enforcement Program, requiring covered entities to submit two separate breach reports for the same data security incident. This new enforcement approach significantly expands HIPAA breach notification requirements and affects all healthcare organizations handling protected health information.
Healthcare covered entities must report all small data breaches affecting fewer than 500 individuals to HHS by March 1, 2026, as part of HIPAA's annual reporting requirement. This deadline applies to breaches discovered in 2025 that fell below the major breach notification threshold but still require documentation and reporting.
PoliWriter generates all the policies and documentation you need for compliance, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free