All insights
Deep dives mapped to the Privacy, Security, and Breach Notification Rules, written for operators who need plain-English explanations, CFR citations, and practical checklists.
Try: BAA, Security Rule, breach notification, PHI, OCR enforcement
Featured insight
Data Breach
Ohio-based Saber Healthcare, California law firm Buchalter, and Indiana dental practice Bright Smile Dental Care have each disclosed HIPAA-reportable incidents. Here is what compliance teams need to know.
Data Breach
The District of Columbia Department of Health Care Finance disclosed that Medicaid beneficiary data was publicly accessible online for roughly three years, affecting nearly 400,000 enrollees. Here is what compliance officers need to know.
Data Breach
MedImpact Healthcare Systems, a large pharmacy benefit management business associate, began mailing breach notification letters in September 2026 for a network intrusion that occurred in October 2025. The nearly year-long gap between incident and notification raises serious HIPAA breach notification rule compliance questions.
Data Breach
A cyberattack on Aesto Health's Amazon Web Services infrastructure exposed the records of roughly 9.54 million patients across 30 covered entity clients. Here is what compliance officers need to know about third-party risk, BAA oversight, and the breach timeline.
Data Breach
TheGentlemen ransomware group has claimed an attack on Nutex Health and is threatening to publish stolen patient data. A class action lawsuit was filed in Texas just three days after Nutex's SEC 8-K disclosure, raising urgent questions about hospital-sector ransomware liability.
Data Breach
The ShinyHunters extortion group claims it leaked 7.1 million Salesforce records from Baxter International containing patient PII. Here is what compliance officers and healthcare vendors need to know about the HIPAA risk exposure.
Data Breach
CareCloud, a cloud-based EHR and practice management vendor, disclosed a breach affecting roughly 345,000 individuals. Learn what was exposed, what compliance obligations this triggers, and what covered entities and business associates should do now.
Data Breach
Optalis Management Solutions, a Michigan-based skilled nursing and rehabilitation management company, notified 13,723 individuals of unauthorized network access occurring April 14–19, 2025. At least one additional entity disclosed an email breach exposing sensitive patient data. Neither incident is an OCR enforcement action, and no fines have been announced.
Data Breach
Five small healthcare organizations spanning primary care, oral surgery, vision care, and insurance benefits have newly disclosed patient data breaches under the HIPAA Breach Notification Rule. Here is what compliance officers need to know.
Data Breach
Ohio-based healthcare software provider Unlimited Technology Systems disclosed an unauthorized intrusion at its commercial datacenter that may have exposed sensitive data for roughly 3.8 million individuals, making it the largest healthcare breach reported to HHS so far in 2026.
Data Breach
Amgen disclosed in a Form 8-K that attackers exfiltrated patient PHI from cloud environments managed by outside vendors, not from Amgen's own systems. The breach triggers HIPAA's 60-day notification clock and SEC dual-reporting obligations simultaneously.
Data Breach
Four healthcare facilities have disclosed new patient data breaches, including Wildwood Surgical Center, which took over a year to complete its post-incident data review. Compliance officers should note the notification timeline implications.
Data Breach
Threat intelligence tracker BreachSense logged a ransomware claim by 'TheGentlemen' against Advantage Home Health Care on July 20, 2026. Here is what compliance officers and home health administrators need to know now.
Data Breach
U.K.-based healthcare billing software maker Craneware disclosed that hackers stole a significant volume of customer, employee, and partner data from its systems. Here is what compliance officers need to know now.
Data Breach
The Qilin ransomware group listed Hillebrand Home Health on its dark web leak site on July 14, 2026. Here is what compliance officers and home health administrators need to know right now.
Data Breach
A Minnesota hospital system notified patients more than 14 months after an unauthorized party accessed its network, exposing Social Security numbers, medical records, and financial data. Here is what compliance teams need to know.
Data Breach
Family Health Centers of Southern Indiana disclosed a January 2026 network intrusion that exposed patient names, dates of birth, Social Security numbers, medical information, and health insurance data. The five-month gap between detection and public disclosure raises serious questions about HIPAA breach notification compliance.
Data Breach
The Texas Hearing Institute in Houston notified at least 29,498 individuals after the Interlock ransomware group claimed a March 2026 attack exfiltrated 540 GB of data including Social Security numbers, financial records, and medical information.
Data Breach
Wisconsin DHS reported a HIPAA breach to OCR after benefit increase letters for 8,157 Medicaid SSI recipients were mailed to outdated addresses. Learn what this means for HIPAA breach notification obligations at government-run health programs.
Data Breach
ShinyHunters claimed responsibility for a June 2026 breach of One Medical Seniors legacy systems, threatening to expose a reported 8.8 terabytes of archived patient records. Here is what compliance officers need to know about HIPAA obligations that survive acquisitions.
Data Breach
OpenLoop Health, a white-label telehealth infrastructure vendor and business associate to numerous digital health companies, disclosed a January 2026 breach in which an unauthorized party removed data from its systems. Here is what covered entities and their compliance teams need to know.
Data Breach
A January 2026 phishing attack on AI utilization management vendor Xsolis exposed 1.4 million patient records across seven hospital systems. The breach also raises a serious HIPAA notification timing question: Xsolis reportedly waited 135 days before notifying HHS, well beyond the 60-day rule for business associates.
Data Breach
Kettering Health declined to pay the Interlock ransomware group. The attackers leaked the stolen data, exposing roughly 1.7 million people, including passports and plaintext credentials. Why refusing to pay does not change your HIPAA obligations, and what the breach reveals.
Data Breach
A ransomware attack on Conduent, a business process vendor serving health plans and government programs, started as a 4-million-person breach and grew into one of the largest in U.S. history. What it means for every health plan and covered entity that relies on a vendor.
Data Breach
A third-party vendor breach at NYC Health + Hospitals exposed roughly 1.8 million records from late November 2025 through February 2026, including biometric data such as fingerprints and palm prints. The Senate HELP Committee is now pressing the health system for answers.
Data Breach
NYC Health + Hospitals, Erie Family Health, and other large breaches recently posted to the HHS 'Wall of Shame' share one root cause: a third-party vendor. What the supply-chain breach pattern means for your practice, and what to do about it.
Data Breach
A complete guide to HIPAA breach response — from the moment of discovery through notification to HHS, individuals, and media. Includes the four-factor risk assessment, deadlines, and role-specific responsibilities.
Data Breach
When a breach happens, the clock starts immediately. A plain-English guide to who you must notify, the 60-day deadline, and the four-factor risk assessment, with CFR citations.
Data Breach
What to do in the first 60 days after a breach: assess, document, notify individuals and HHS, and avoid the mistakes that turn a breach into a penalty.