HIPAA Pulse moved to hipaapulse.com. This page is HIPAA Response — what to do about each story.
See responsesPatient Protect · HIPAA Response
Live22
Total incidents tracked
1,758
Active responses
90
Update cadence
Hourly
HIPAA Responseis the technical-enablement layer of HIPAA Pulse’s reporting. Every breach the publication covers, every OCR enforcement action, every regulatory development — paired with the controls, configurations, and platform actions your practice needs to do something about it.
Patient Protect Synopsis
Recent analyses indicate a significant surge in cyberattacks targeting healthcare service providers, more than doubling in the first half of 2026, while direct attacks on hospitals saw modest growth. Phishing campaigns, particularly vishing and AI-enhanced credential theft, are becoming increasingly sophisticated, targeting Microsoft 365 accounts and leveraging multi-factor authentication abuse. Healthcare organizations are also facing a rise in class-action lawsuits following data breaches, underscoring the legal and financial repercussions of inadequate data protection.
By Patient Protect Research · Synthesized from HIPAA Pulse coverage · AI-assisted, editor reviewed
Sophisticated phishing and vishing attacks are on the rise, with new groups like Helix and platforms like Forg365 using AI and multi-factor authentication (MFA) abuse to target Microsoft 365 accounts, posing a direct…
The healthcare service provider sector is experiencing a disproportionate increase in cyberattacks, highlighting a critical vulnerability in the broader healthcare supply chain that requires enhanced security measures.
An increase in class-action lawsuits against healthcare corporations for data breaches and unauthorized sharing of personal information indicates a growing legal precedent and heightened scrutiny on patient data privacy.
Healthcare organizations must immediately bolster their defenses against vishing and AI-powered phishing, focusing on robust employee training for identifying sophisticated social engineering tactics and implementing…
Conduct a thorough security assessment of third-party healthcare service providers and business associates to identify and mitigate vulnerabilities within the extended healthcare ecosystem, as these entities are…
Review and update data privacy policies and incident response plans to address potential legal challenges from data breaches, ensuring compliance with HIPAA and other relevant regulations, and preparing for class-action…
The Response Desk
Jul 8
A wave of class action lawsuits filed in state and federal courts targets large healthcare corporations accused of exposing or improperly sharing patients' protected health information and personally identifiable information.
AdaptHealth disclosed a social-engineering breach to the SEC that gave attackers access to patient management systems, document storage, an external EHR, and insurance billing credentials.
Medtronic disclosed a data breach affecting 3.8 million people after the ShinyHunters extortion group accessed its corporate IT systems in April 2026.
Medtronic has begun notifying customers after the ShinyHunters threat group obtained personal data through a breach of a third-party platform used by the medical device maker.
Federal court lets negligence claims stand against MOVEit breach defendants for the second time, keeping healthcare organizations and their file-transfer vendors in the crosshairs of multi-district litigation.
The First Circuit upheld dismissal of a class action against a Puerto Rico hospital after finding the plaintiff could not connect her alleged injuries to the provider's 2019 ransomware attack.
Colorado Health Network began notifying patients in June 2026 of a breach first flagged by threat actors in August 2025, nearly a year after the incident, with the scope and cause still not publicly disclosed.
Healthcare technology company Xsolis disclosed a phishing-driven data breach that exposed sensitive information belonging to nearly 1.4 million individuals.
Xsolis, an AI-driven clinical decision-support company serving health systems, disclosed a data breach affecting 1.4 million individuals whose personal and protected health information was held on its systems.
Xsolis, a healthcare AI and utilization-management business associate, disclosed a breach affecting more than 1.3 million patients across its network of provider and payer clients.
Cherry Health, a Michigan-based community health provider, disclosed that an unknown actor accessed its network and copied data in an incident first detected on April 19, 2026.
Houston-based Blue Fish Pediatrics notified 41,485 Texas patients nearly a year after a July 2025 breach exposed names, dates of birth, Social Security numbers, and protected health information.
ShinyHunters claims to have stolen 8.8TB of data from Amazon-owned primary care network One Medical and has set a June 22 deadline for negotiations before threatening to publish the files.
HHS OCR settled with the employer-sponsored health plan of national retailer Spencer Gifts for $450,000 and a corrective action plan following a ransomware attack that exposed protected health information.
HCRG Care Group waited more than a year to notify patients of a February 2025 Medusa ransomware attack, despite public reporting that exposed the stolen data months earlier.
A hospital worker at the private London clinic where the Princess of Wales underwent abdominal surgery in 2024 is set to face criminal prosecution after an investigation into unauthorized staff access to her medical records.
Ireland's Data Protection Commission fined the Health Service Executive €300,000 over a 2018 ransomware attack on a laboratory information system at a regional hospital that exposed patient data.
iRhythm Holdings disclosed a breach in which hackers stole patient personal and health information from third-party-hosted business applications used by the cardiac monitoring company.
A China-linked espionage group breached internet-exposed REDCap servers at a North American medical institution, deploying novel malware to extract sensitive research data.
A Ukrainian national pleaded guilty to conspiracy charges tied to the Conti ransomware operation, which targeted hospitals and healthcare systems in attacks that caused widespread disruption across the sector.
LabCorp agreed to a $35 million settlement stemming from the 2019 American Medical Collection Agency data breach, which exposed the records of more than 10 million patients.
A women's health advocacy group is preparing a mass lawsuit against clinical diagnostics lab Eurofins after a 2025 ransomware attack exposed cervical cancer screening data for 850,000 patients.
Japan's National Hospital Organization says hard drives from two Hokkaido hospitals were sold on online auction sites, exposing personal data on up to 510,000 patients and staff.
Mid and South Essex NHS Foundation Trust confirmed that roughly 2,380 patient test records were stolen in a cyber attack traced to a breach at third-party pathology provider Synnovis.
ShinyHunters extortion group leaked approximately 234 GB of data allegedly stolen from dental benefits administrator DentaQuest, affecting an estimated 2.6 million individuals.
Archive
Every article previously published — searchable, with permanent URLs preserved.
By practice type
Five fast-growing segments where HIPAA-applicability is genuinely contested. Each page covers exactly when HIPAA applies, where the gray zones live, the state consumer-health law overlay (Washington MHMDA, Nevada CHPA, Connecticut DPA, California CMIA), and the operational checklist for compliant operation.
When membership-based primary care still triggers covered-entity status — and the 5-step path to clean operation.
Open
The most state-law-exposed segment in healthcare. WA MHMDA, NV CHPA, pharmacy BAA cascade, multi-state notification matrix.
Open
DEA EPCS for testosterone, compounding pharmacy BAAs, specialty hormone labs — the four-dimensional compliance matrix.
Open
Prominent-patient threat model. Compartmentalized access controls under §164.502(b) and heightened breach response.
Open
Hybrid-entity strategy under §164.105. Photo storage compliance and the medical-component analysis most operators skip.
Open
Biweekly briefing
HIPAA Pulse’s editorial digest paired with Patient Protect’s response notes — what happened, why it matters, what to do.
No spam. Unsubscribe anytime.
