Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationOn October 2, South African pathology firm Ampath Laboratories detected and contained a cybersecurity incident. Two weeks later, the threat actor ByteToBreach claimed on a dark web forum to have stole
Breach NotificationWhen 77 healthcare data breaches appear on the OCR s portal in a single month, affecting over 33 million individuals, it s not just bad luck. It s a pattern of predictable mistakes that compliance tea
Breach NotificationWhen Twin Cities Pain Clinic settled class action litigation following a business email compromise attack in July 2025, the financial toll included a $385,000 cap for cash payments, plus attorneys fee
OCR Enforcement & PenaltiesA Pennsylvania dental practice paid $140,000 to settle HIPAA violations, not for a data breach or ransomware attack, but for missing paperwork. The Office for Civil Rights (OCR) asked Shen Smiles for
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworkMisconceptions About Compliance Small healthcare providers often think they re too small to need formal HIPAA compliance programs. You might hear, We re just a two-dentist practice. Everyone knows to
Breach NotificationWhen Millstone Medical Outsourcing detected suspicious activity on December 16, 2025, it launched an investigation. Nine months later, in September 2026, it disclosed a breach affecting Social Securit
Breach NotificationWhen you review breach settlements like Valley Oaks Health s recent preliminary approval, you might draw the wrong conclusions. This settlement covered 50,352 affected individuals and includes up to $
Breach NotificationTwo recent breaches at Casper Orthopedic Associates and Atlantic Digestive Specialists reveal a troubling gap in healthcare cybersecurity: while most organizations can detect an intrusion quickly, con
Breach NotificationWhen Oracle Health disclosed a breach affecting legacy Cerner systems in 2025, the initial report to federal regulators listed 501 patients. By October 2026, that number had climbed to 20 million. Thi
Breach NotificationThese questions are common in compliance team meetings and privacy officer discussions. After Labcorp agreed to a $2.29 million settlement over a 2019 breach involving its debt collector, AMCA, concer
Breach NotificationDetect Unauthorized PHI Access Before It s Too Late You need to detect unauthorized access to PHI before the OCR does. This alert configuration template helps you set up automated monitoring rules to
Breach NotificationYou re two days into a long weekend when the call comes: an employee clicked a link in what looked like a routine email from a trusted vendor. By the time your security team flagged the anomaly, an un
Individual RightsAdaptHealth discovered its breach not from a monitoring alert but from the attacker themselves. A contractor s compromised session had already reached patient management systems, document storage plat
OCR Enforcement & PenaltiesYou ve probably heard the reassurances: Analytics tools don t collect PHI, or It s just aggregate data. Then you read about two more hospitals settling class action lawsuits over Meta Pixel and Google
Breach NotificationYou ve just received a breach notification from one of your Business Associates . Or maybe you re reviewing your vendor list and wondering which relationships deserve immediate attention. Either way,
Breach NotificationTwo SQL injection attacks in one country. Nearly 24 million patient records exposed. The same threat actor claiming credit for both breaches. If your organization runs on third-party medical software,
Regulatory FrameworkHealthcare organizations spent an average of $6.64 million per breach in 2024, according to the IBM and Ponemon Institute s Cost of a Data Breach Report . That s the highest industry cost for the 13th
Breach NotificationThe Problem: Why This Matters Now You ve got a cybersecurity incident. Maybe your SIEM flagged unusual network activity, a vendor called with bad news, or your forensic team just confirmed unauthorize
OCR Enforcement & PenaltiesThe Conventional Wisdom When the OCR announces another right-of-access settlement, compliance officers often react predictably: update the access policy, schedule training, and document everything. Th
Breach NotificationThird parties now account for 32% of healthcare breaches, according to Verizon s 2026 Data Breach Investigations Report . Seven of the ten largest breaches in the first half of 2026 involved a busines
