Compliance and Regulations
Stay up-to-date of data protection regulations updates and industry compliance standards evolution. Learn about HIPAA, GDPR and data protection laws, compliance requirements specific to your industry, and stay up-to-date on legal developments affecting security practices. Stay inform on notable data breaches and security incidents related.
$3.4M Settlement Proposed by Nationwide Vision/Sightcare to Resolve Class Action Lawsuit
A $3.45 million settlement was proposed to resolve a combined class action lawsuit associated with a data breach at USV Optical, a U.S. Vision subsidiary. The 2021 data breach impacted over 710,000 people, which included … Read more
312,000 Patients Impacted by Texas Retina Associates Cyberattack
Texas Retina Associates (“Texas Retina”) encountered a cyberattack that impacted over 312,000 patients. This company is the biggest ophthalmology practice with 15 practices established in Dallas, Texas. The attack involved unauthorized access to its network … Read more
Is it a Violation of HIPAA to Email Medical Records?
It is not a violation of HIPAA to email medical records as long as the reason for emailing PHI is a required, permissible, or excepted reason under the Privacy Rule, as long as the disclosure … Read more
What are the HIPAA Email Rules?
The HIPAA email rules are that email can only be used to send, receive, or store Protected Health Information (PHI) if the reason for PHI being disclosed is consistent with the Privacy Rule, and if … Read more
Sisense Data Breach Impacts About 20,000 Aptihealth Patients
The digital mental health solutions company Aptihealth based in Saratoga Springs, NY has reported the exposure or theft of the protected health information (PHI) of 19,805 patients. It uses its digital platform to provide mental … Read more
512,000 Consulting Radiologists Patients Affected by Cyberattack
Consulting Radiologists is a radiology services firm based in Edina, Minnesota. The companybegan sending personal notifications to approximately 512,000 patients impacted by a cyberattack in February 2024. Consulting Radiologists provides 22 hospitals and clinics with … Read more
Columbia University Irving Medical Center Patient Data Exposed Online
Columbia University Irving Medical Center (CUIMC) submitted a data breach report to the HHS’ Office for Civil Rights on May 6, 2024 indicating that 29,629 individuals were affected. New York-Presbyterian (NYP) and CUIMC were informed … Read more
Ascension Confirms Initial Access Vector and Data Theft During a Ransomware Attack
Ascension has reported the theft of files from a few servers during its latest ransomware attack. Some files included personally identifiable information (PII) and protected health information (PHI). The attackers accessed servers that were employed … Read more
MicroDicom DICOM Viewer Two New High Severity Vulnerabilities
The MicroDicom DICOM Viewer medical image viewer was found to have two high-severity vulnerabilities. One vulnerability can result in arbitrary code execution. The other vulnerability could enable an attacker to get sensitive data, put new … Read more
Legal Basis for Monitoring Healthcare Employees
The monitoring of employees has become an indispensable practice for organizations to guarantee security, productivity, and compliance with regulations. Sensitive patient data is handled in the healthcare sector every day, making the stakes even higher. … Read more
Large Healthcare Companies Need to Improve Cybersecurity Measures
Senate Finance Committee chair, Senator Ron Wyden sent a letter to the Department of Health and Human Services (HHS) through Secretary Xavier Becerra asking big healthcare organizations to improve their cybersecurity protocols. One factor in … Read more
Designed Receivable Solutions Lawsuit Due to 500M-Record Data Breach
Revenue cycle management company, Designed Receivable Solutions based in Cypress, CA, is facing a class action lawsuit associated with a data breach that impacted more or less half a million people. The company detected an … Read more
Health Data of Texas Panhandle Centers Patients Exposed in October 2023 Data Breach
Certified Community Behavioral Health Clinic, Texas Panhandle Centers (TPC) based in Amarillo, TX uncovered unauthorized access to its computer network and the compromise of 16,394 patients’ personal data and protected health information (PHI). TPC, which … Read more
New Reproductive Health Care Privacy Rule Released Under HIPAA
The Final Rule ensures the privacy protection of the health records of women, their members of the family, and physicians who are seeking, getting, offering, or assisting legal reproductive health care. The Biden-Harris Administration and … Read more
Warning Against Different Types of Business Email Compromise Attacks
The Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) is warning the healthcare and public health (HPH) sector concerning business email compromise (BEC) attacks. BEC attacks refer to a type … Read more
Class Action Suits for Cybersecurity Breaches
What is a class action? Since the 1820 case of West v. Randall, the class action lawsuit has been firmlyestablished as a powerful tool in the federal judicial system of the USA. A class actionenables … Read more
Discovered Vulnerabilities in GE Healthcare Ultrasound Products and in Desktop Windows Manager
11 Vulnerabilities Discovered in GE HealthCare Ultrasound Products About 12 vulnerabilities were discovered in GE HealthCare Vivid Ultrasound devices that threat actors can exploit to access and modify patient information, and possibly install ransomware to … Read more
How to Make ChatGPT HIPAA Compliant
The way to make ChatGPT HIPAA compliant is to deploy anonymizing software between users and the ChatGPT program in order that no Protected Health Information is disclosed to ChatGPT. However, when using this solution, it … Read more
Settlement of Class Action Lawsuits by Gifted Healthcare and Presbyterian Healthcare Services
Settlement Offered to Settle Gifted Healthcare Data Breach Lawsuit Gifted Healthcare has offered to settle a class action lawsuit that claimed negligence for not implementing appropriate cybersecurity steps that resulted in a data breach. The … Read more
PHI Exposed in Tennessee Eye Clinic Network, Somerset Dental Las Vegas and Catholic Medical Center Cyberattacks
BianLian Threat Group Attacks Tennessee Eye Clinic Network Politzer and Durocher, PLC, also called Optometric Physicians of Middle Tennessee (OPMT), submitted a hacking incident report to the HHS Office for Civil Rights that impacted the … Read more
Orrick, Herrington & Sutcliffe Settles Lawsuit and Ernest Health’s Recent Lawsuit
Orrick, Herrington & Sutcliffe Pay $8 Million to Settle Class Action Data Breach Lawsuit The law agency Orrick, Herrington & Sutcliffe based in San Francisco, CA is paying $8 million to settle a class action … Read more
Planned Parenthood Los Angeles Settles Lawsuit and Children’s Healthcare of Atlanta Pixel-Related Lawsuit
Planned Parenthood Los Angeles Settles Class Action Data Breach Lawsuit for $6 Million Reproductive healthcare services provider Planned Parenthood Los Angeles located in Los Angeles County proposed a $6 million settlement to take care of … Read more
Social Media and HIPAA Compliance
The challenge with social media and HIPAA compliance is that covered entities and business associates cannot disclose Protected Health Information unless the disclosure is permitted by the Privacy Rule. This restriction should apply to members … Read more
How to Make Microsoft 365 HIPAA Compliant
The way to make Microsoft 365 HIPAA compliant so it can be used to create, receive, store, or transmit Protected Health Information is to subscribe to a plan that supports HIPAA compliance and configure each … Read more
How to Make Google Workspace HIPAA Compliant
The way to make Google Workspace HIPAA compliant is to subscribe to a Workspace Plan that supports HIPAA compliance, agree to the terms of Google’s Business Associate Addendum, and configure the core services included in … Read more
Credential Harvesting Prevention and Alert Against Volt Typhoon Threat
HHS Offers Guidance on Credential Harvesting Mitigations The Health Sector Cybersecurity Coordination Center (HC3) has given a healthcare and public health (HPH) sector advisory regarding credential harvesting, a frequent tactic employed in cyberattacks on the … Read more
Does Zelle Need to be HIPAA Compliant?
Zelle does not need to be HIPAA compliant before covered entities can use the fund transfer service to collect payments from patients and plan members because of an exemption in HIPAA for payment processors. However, … Read more
Is it Necessary for Ivy Pay to be HIPAA Compliant?
It is necessary for Ivy Pay to be HIPAA compliant if a healthcare provider who qualifies as a HIPAA covered or hybrid entity wants to use the payment processing software for functions that involve uses … Read more
Reports of Cyberattacks and Data Breaches by Valley Oaks Health, Sycamore Rehabilitation Services, Humana Inc., and Jewish Home Lifecare
50,000-Record Data Breach at Valley Oaks Health, Indiana Valley Oaks Health based in Niles, IL recently informed 50,352 persons concerning a breach of its system environment. Unauthorized persons acquired access to sections of its system … Read more
HIPAA Security Audit Requirements
The HIPAA security audit requirements are that covered entities and business associates conduct a thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of PHI and implement security measures sufficient … Read more
Does PayPal Need to be HIPAA Compliant to Accept Payments for Healthcare?
PayPal does not need to be HIPAA compliant to accept payments for healthcare due to an exemption in HIPAA that applies to all banks and financial institutions for payment processing. However, banks and financial institutions … Read more
Email Account Breaches Reported by McKenzie County Healthcare System and Maryville Addiction Treatment Centers
Email Account Breach Reported by McKenzie County Healthcare System McKenzie County Healthcare System located in North Dakota has discovered unauthorized access to the email account of a staff member. The breach was discovered on or … Read more
Reported Data Breaches by Medical Management Resource Group, Prime Healthcare, AGC Flat Glass North America, and Aspen Dental
2.35M Patients Affected by Medical Management Resource Group Breach Medical Management Resource Group, LLC (MMRG), also called American Vision Partners, has confirmed in a breach notification letter sent to the HHS’ Office for Civil Rights … Read more
Data Brokers Should Be Held Responsible for Misusing Geolocation Information
U.S. Senator Ron Wyden (D-OR) wrote to the Securities and Exchange Commission (SEC) and the Federal Trade Commission (FTC) asking for action to secure people and investors from Near Intelligence Inc., a publicly owned data … Read more
U.S. Health Department Expands National Health Data Exchange with New QHINs
The Department of Health and Human Services (HHS), through its Office of the National Coordinator for Health Information Technology (ONC), recently announced the expansion of the Trusted Exchange Framework and Common Agreement (TEFCA) with two … Read more
Italian Data Protection Authority Accuses ChatGPT of violating GDPR
OpenAI’s ChatGPT Faces Data Protection Challenges in Italy. In a press release published on Monday January 29, the italian data protection authority, Garante, has taken a firm stance against OpenAI, the company behind ChatGPT, for potential … Read more
Cyberattack and Data Breaches at Anna Jaques Hospital, NYC Health + Hospitals, and Corewell Health Business Associate
Anna Jaques Hospital Cyberattack on Christmas Day Anna Jaques Hospital located in Newburyport, MA, encountered a cyberattack on Christmas Day that caused an interruption to its health record system. It was decided to redirect ambulances … Read more
MOVEit Hack Impacts Delta Dental of California and Pan-American Life Insurance Group
MOVEit Hack Impacts 7 Million People from Delta Dental of California Delta Dental of California reported that it suffered from a mass exploitation conducted by the Clop hacking group of a zero-day vulnerability identified in … Read more
New York Presbyterian Hospital Pays $300K Fine for Using Website Pixel
New York Presbyterian Hospital has decided to resolve alleged Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule violations by paying the New York Attorney General a $300,000 financial penalty. NYP manages 10 hospitals around … Read more
Guidance on Managing Legacy Medical Devices and Advisory Against Rhysida Ransomware Attacks
FDA Releases Guidance on Managing Legacy Medical Device Cybersecurity Risks The U.S. Food and Drug Administration (FDA) has released a report that recommends how to handle the cybersecurity problems of legacy medical gadgets. Legacy medical … Read more
HIPAA Cases Against Doctors’ Management Services and Wright & Filippis Resolved
Doctors’ Management Services Resolves OCR HIPAA Case for $100,000 The HHS’ Office for Civil (OCR) has consented to resolve an investigation of a ransomware attack and data breach that revealed several potential HIPAA Security Rule … Read more
Data Breaches Reported by Fairfax Oral and Maxillofacial Surgery, Henwood Family Dentistry, Piedmont Healthcare and Surround Care
Fairfax Oral and Maxillofacial Surgery Ransomware Attack Impacts 236,000 Individuals Fairfax Oral and Maxillofacial Surgery based in Virginia has reported the potential compromise of the protected health information (PHI) of around 235,931 persons in a … Read more
Advisory on Snatch Ransomware and the Lazarus Group
Feds Release Snatch Ransomware Alert After an Attack on Hospital The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released a joint security alert regarding Snatch ransomware. The … Read more
How does HIPAA compliance apply to healthcare administration firms?
Healthcare administration firms must adhere to HIPAA compliance, ensuring the confidentiality, integrity, and availability of PHI by implementing administrative, physical, and technical safeguards, thus mitigating risks of unauthorized access or disclosure and maintaining trust in … Read more
Health Care Service Corporation and Schneck Medical Center Face Lawsuit
HIPAA Lawsuit Against Schneck Medical Center Resolved Schneck Medical Center based in Seymour, IN has resolved a lawsuit with Attorney General Todd Rokita of Indiana, regarding a ransomware attack and data breach in 2021 that … Read more
How can a clinical research organization ensure HIPAA compliance?
To ensure Clinical Research Organization HIPAA compliance, a Clinical Research Organization must systematically safeguard PHI through robust encryption and access controls, provide regular training to employees on data privacy, implement stringent data security policies and … Read more
How does HIPAA compliance apply to population health management?
In the field of population health management, HIPAA compliance is an important as it mandates the safeguarding of patient data and confidentiality during the collection, analysis, and sharing of health information to improve community health … Read more
How can a health informatics company ensure HIPAA compliance?
A health informatics company can ensure HIPAA compliance by implementing rigorous data protection protocols, conducting regular training sessions for employees on safeguarding patient information, continuously monitoring and updating their systems to prevent breaches, and collaborating … Read more
How does HIPAA compliance apply to digital health interventions?
Digital health interventions HIPAA compliance is important because it ensures that digital platforms, applications, and tools involved in delivering healthcare services adhere to the stringent standards set by HIPAA to safeguard patient data and maintain … Read more
How can a personal care agency ensure HIPAA compliance?
A personal care agency can ensure HIPAA compliance by implementing rigorous data privacy and security measures, including training staff on the importance of protecting patient information, using encrypted communication and storage systems, conducting regular audits … Read more
