Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationThese questions landed in my inbox last week after news broke that Ambry Genetics agreed to pay a $700,000 HIPAA fine for a 2020 phishing incident that exposed the information of 225,000 patients. The
Breach NotificationThe Labcorp settlement with 44 state attorneys general answers this question the hard way: after costs $2,287,455, plus whatever you spend implementing the mandated security program. The 2019 AMCA bre
Breach NotificationThe Challenge OneTouchPoint Corp., a Wisconsin-based printing and mailing services vendor, discovered encrypted files on its network on April 28, 2022. A forensic investigation traced the intruder s f
OCR Enforcement & PenaltiesScope This guide covers the seven HIPAA provisions OCR evaluated during its 2016-2017 desk audits of 166 covered entities and 41 business associates. It includes steps for implementing requirements wh
Get weekly security insights and compliance updates delivered to your inbox.
Breach NotificationWhat the Data Shows Between December 2025 and September 2026, four healthcare organizations disclosed data breaches that revealed a troubling pattern: the gap between detection and notification often
Breach NotificationWhen a hacker accesses your servers and compromises Protected Health Information (PHI) , you ll face a critical decision: negotiate an early settlement or defend your security practices in court. The
Breach NotificationYou ve hardened your perimeter, run quarterly vulnerability scans, and have a vendor risk management program. So you re protected from class action litigation after a breach, right? Not even close. Th
Breach NotificationThe Conventional Wisdom When a Business Associate suffers a massive breach, compliance teams often feel secure if they have a signed Business Associate Agreement (BAA). The thinking is: we ve done our
Regulatory FrameworkA phishing email cost Ambry Genetics $700,000 in regulatory penalties and $12.25 million in lawsuit settlements. The breach exposed 225,370 individuals ePHI over three days in January 2020. However, t
Breach NotificationYou ve secured your network, trained your staff on phishing, and passed your last Security Rule risk analysis. Then your vendor gets compromised, and you re notifying 28,000 patients anyway. That s wh
Breach NotificationScope This guide outlines the legal and operational steps your organization must take when a data breach leads to class action litigation. You ll learn about the regulatory framework, timeline require
OCR Enforcement & PenaltiesThe Vastaamo breach is one of healthcare s most devastating cyberattacks. A hacker stole psychotherapy records of 33,000 people, published 300 patients therapy notes online, and extorted individual vi
Individual RightsA ransomware attack doesn t end when you restore your systems. DaVita s $15 million settlement following an April 2025 incident that exposed information belonging to nearly 2.4 million people shows ho
Breach NotificationYou ve signed the business associate agreement. Your vendor passed the initial security questionnaire. You re confident that the third party managing your legacy EHR data won t become a liability. The
Breach NotificationThe common belief is that settling data breach lawsuits is a smart business move. It avoids lengthy litigation, caps exposure, and allows you to move on. Central Maine Medical Center and Susan B. Alle
Breach NotificationContext: Questions from the Front Lines These questions arise from real conversations with business associate compliance teams following the AdaptHealth breach disclosure. When a social engineering at
Breach NotificationHealthcare organizations often practice breach response procedures, conduct tabletop exercises, and maintain incident response plans. Yet, operational failures still appear in settlement after settlem
Breach NotificationScope This guide focuses on the technical controls and operational practices your team needs to implement in response to the 239% increase in hacking-related healthcare data breaches from January 2018
Breach NotificationIn June 2026, 66 large healthcare data breaches affected at least 4,499,972 individuals. The numbers tell a clear story: hacking incidents at Business Associates now dominate, accounting for 81.8% of
Breach NotificationA four-hour window. That s all it took for an unauthorized person to access an employee email account at Integrative Emergency Services and view Protected Health Information (PHI). The company detecte
