Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationThe Conventional Wisdom Walk into any compliance conference and you ll hear the same refrain: We need better security awareness training. A phishing incident occurs, and the solution is another mandat
Breach NotificationOn December 18, 2025, Aesto Health discovered unauthorized access to its AWS infrastructure. By the time the Birmingham-based healthcare technology company completed its investigation and notified aff
Breach NotificationWhen a business associate s cloud intrusion exposes 3.7 million patient records, as CareCloud s six-day AWS breach did from March 10 to March 16, 2026, covered entities find themselves responsible for
Breach NotificationYou ve just discovered suspicious network activity. Or worse, you ve confirmed unauthorized access. The clock is ticking, and you re facing decisions that will determine your regulatory exposure, noti
Get weekly security insights and compliance updates delivered to your inbox.
Breach NotificationThese myths persist because third-party risk management sits between your security team s control and your vendors promises. When ShinyHunters claimed the theft of 284 million records from McKesson th
Breach NotificationPurpose of the Checklist Your team just brought systems back online after a security incident. Business units are celebrating, and the board wants an all clear statement. Your CEO is asking if you can
Breach NotificationUnderstanding the Breach Between March and August 2025, attackers compromised Salesloft s GitHub account, stole OAuth authentication tokens from its Drift AI chat platform, and used those tokens to ac
Breach NotificationYou ve enabled encryption in Microsoft 365. You ve signed Business Associate Agreements . You ve trained staff to type Secure in subject lines. And you re still exposed. These myths persist because th
Breach NotificationQuestions about OCR s enforcement are flooding in from assessors working with smaller covered entities and business associates. The pattern is clear: OCR s enforcement strategy has shifted. The old fo
Breach NotificationWhen DAP Health faced a class action lawsuit after a cyberattack exposed the Protected Health Information (PHI) of 129,048 individuals, the resulting $1.3 million settlement didn t just reflect the br
Breach NotificationWhen Tift Regional Health System notified 180,142 patients about a data breach in August 2023, the attack had happened nearly a year earlier. That delay became a core allegation in the class action la
Breach NotificationDAP Health s $1.3 million settlement following a 2024 email server breach affecting 129,048 individuals highlights a harsh reality for nonprofit healthcare organizations: breach response costs often f
Breach NotificationCentral Maine Healthcare agreed to a $1,368,025 settlement in July 2026 to resolve class action claims from a 2025 data breach . The healthcare system detected unusual network activity on June 1, 2025
Breach NotificationWhen Medical Management Resource Group LLC reached a $1.75 million settlement in August 2026 for a breach affecting over 2.35 million individuals, it revealed more than just financial penalties. It ex
