Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationIn June 2026, 66 large healthcare data breaches affected at least 4,499,972 individuals. The numbers tell a clear story: hacking incidents at Business Associates now dominate, accounting for 81.8% of
Breach NotificationA four-hour window. That s all it took for an unauthorized person to access an employee email account at Integrative Emergency Services and view Protected Health Information (PHI). The company detecte
Breach NotificationWhen a cancer treatment device maker like Novocure becomes the target of a data extortion gang, it shows that your organization s size and specialization won t protect you. Novocure discovered unautho
Breach NotificationWhen American Addiction Centers (AAC) disclosed their second data breach in two years, this time through a Business Associate s Salesforce environment, the incident report contained a telling detail:
Get weekly security insights and compliance updates delivered to your inbox.
Breach NotificationUnderstanding the Impact of Breach Settlements When MCNA settled its class action lawsuit for a 2023 data breach affecting 8.9 million individuals, compliance officers were eager to understand the imp
Breach NotificationWhen ransomware locks your systems, you re faced with a decision that has immediate financial, operational, and compliance consequences. You need a framework before the attack happens, not while your
Breach NotificationThe breach at Aesto Health wasn t just a cloud issue. It was a single AWS compromise that affected over two dozen healthcare providers, exposing data for more than 9.5 million patients. When you outso
Breach NotificationThe Decision at Hand When a data breach leads to class action litigation, you must decide whether to settle quickly or contest the claims in court. Highlands Oncology Group opted for settlement after
Breach NotificationWhen The Gentlemen ransomware group exfiltrated data from Nutex Health s servers in August 2026, the Houston-based healthcare company faced a significant cybersecurity incident. The attack followed a
Breach NotificationThe Challenge On April 12, 2025, the Interlock ransomware group infiltrated DaVita s network, stealing data and encrypting files. This breach impacted one of the largest kidney dialysis providers in t
Breach NotificationThe Conventional Wisdom Walk into any compliance conference and you ll hear the same refrain: We need better security awareness training. A phishing incident occurs, and the solution is another mandat
Breach NotificationOn December 18, 2025, Aesto Health discovered unauthorized access to its AWS infrastructure. By the time the Birmingham-based healthcare technology company completed its investigation and notified aff
Breach NotificationWhen a business associate s cloud intrusion exposes 3.7 million patient records, as CareCloud s six-day AWS breach did from March 10 to March 16, 2026, covered entities find themselves responsible for
Breach NotificationYou ve just discovered suspicious network activity. Or worse, you ve confirmed unauthorized access. The clock is ticking, and you re facing decisions that will determine your regulatory exposure, noti
Breach NotificationThese myths persist because third-party risk management sits between your security team s control and your vendors promises. When ShinyHunters claimed the theft of 284 million records from McKesson th
Breach NotificationPurpose of the Checklist Your team just brought systems back online after a security incident. Business units are celebrating, and the board wants an all clear statement. Your CEO is asking if you can
Breach NotificationUnderstanding the Breach Between March and August 2025, attackers compromised Salesloft s GitHub account, stole OAuth authentication tokens from its Drift AI chat platform, and used those tokens to ac
Breach NotificationYou ve enabled encryption in Microsoft 365. You ve signed Business Associate Agreements . You ve trained staff to type Secure in subject lines. And you re still exposed. These myths persist because th
Breach NotificationQuestions about OCR s enforcement are flooding in from assessors working with smaller covered entities and business associates. The pattern is clear: OCR s enforcement strategy has shifted. The old fo
Breach NotificationWhen DAP Health faced a class action lawsuit after a cyberattack exposed the Protected Health Information (PHI) of 129,048 individuals, the resulting $1.3 million settlement didn t just reflect the br
