Compliance Hub - compliance news from every source

HIPAAHighRule changeUnited States3 days ago

ONC cuts health IT certification criteria in HTI-5 final rule

The Office of the National Coordinator reduced 14 certification criteria and revised seven in the HTI‑5 rule, while postponing decisions on information‑blocking requirements.

2 sources

NIST CSF3 days ago
NIST issues guidance on transition to post-quantum cryptography standards
NIST CSF23 hours ago
36 state attorneys general settle with General Motors $220 million over driver data sales
CCPA24 hours ago
California Attorney General fines Lyft $1.8 million over lack of in-app opt-out

Latest

HHS OCR fines Lehigh Valley Health Network $800000 over HIPAA violations
HIPAA8 hours ago
Supreme Court asks MeitY to act against unauthorised court hearing clips
DPDP10 hours ago
New York governor signs AI chatbot law restricting minors’ access
CCPA1 day ago
China's PIPL marks five years with analysis of enforcement trends
GDPR1 day ago
Irish data regulator fines Coinbase Ireland 3.25 million euros over security failure
GDPR1 day ago
Visa and Mastercard drop honor all cards rule in merchant settlement
PCI-DSS1 day ago

Enforcement

Tracker

$800K
Lehigh Valley Health Network
HIPAA
$220M
General Motors
NIST CSFCoalition of state attorneys general
$1.8M
Lyft
CCPACalifornia Attorney General's Office
€3.3M
Coinbase Ireland
GDPRIrish Data Protection Commission

Deadlines

All

13 Nov
In 14 days
DPDP
DPDP Rules: consent manager registration and obligations take effect
19 Dec
In 50 days
HIPAA
Vendor Incident Affects 341,000 Blueberry Pediatrics Patients (breach notification deadline)
26 Dec
In 57 days
HIPAA
Data Breach Announced by NorthShore Health Centers (notification deadline)
21 Jan
In 83 days
GDPR
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data (Compliance deadline)

All stories

Most upvoted in

HIPAAHighEnforcement action8 hours ago
HHS OCR fines Lehigh Valley Health Network $800000 over HIPAA violations
Lehigh Valley Health Network agreed to pay an $800,000 civil penalty to resolve alleged HIPAA privacy and security violations identified by the Office for Civil Rights.
1 source · trade press
DPDPRegulatory update10 hours ago
Supreme Court asks MeitY to act against unauthorised court hearing clips
The Supreme Court directed the Ministry of Electronics and Information Technology to ensure steps are taken to stop illegal uploading of court hearing videos.
1 source · trade press
NIST CSFCriticalEnforcement action23 hours ago
36 state attorneys general settle with General Motors $220 million over driver data sales
General Motors will pay $220 million to settle a lawsuit by 36 state attorneys general alleging unlawful sale of driver‑behavior data to third parties.
1 source · trade press
CCPAHighEnforcement action24 hours ago
California Attorney General fines Lyft $1.8 million over lack of in-app opt-out
Attorney General Rob Bonta secured a $1.8 million civil penalty against Lyft and ordered an in‑app opt‑out for California consumers.
1 source · official
CCPAHighRule change1 day ago
New York governor signs AI chatbot law restricting minors’ access
Governor Kathy Hochul signed S 9051B into law, banning unsafe AI companion chatbot features for minors in New York, following California’s SB 1119.
1 source · trade press
GDPRIndustry news1 day ago
China's PIPL marks five years with analysis of enforcement trends
An analysis published on 29 October 2026 reviews five years of China's Personal Information Protection Law, noting enforcement actions and upcoming regulatory focus.
1 source · trade press
GDPRHighEnforcement action1 day ago
Irish data regulator fines Coinbase Ireland 3.25 million euros over security failure
The Irish Data Protection Commission imposed a €3.25 million penalty on Coinbase Ireland for inadequate security controls that led to a breach.
1 source · trade press
PCI-DSSIndustry news1 day ago
Visa and Mastercard drop honor all cards rule in merchant settlement
Visa and Mastercard agreed to eliminate the honor‑all‑cards requirement while settling litigation with merchants, though the change may have limited impact.
1 source · trade press
ISO 27001Guidance document1 day ago
CREST publishes framework to boost financial cyber resilience
CREST released a whole‑ecosystem framework aimed at strengthening cyber‑resilience practices across banks, insurers and market infrastructure providers.
1 source · trade press
NIST CSFHighEnforcement action1 day ago
Federal Trade Commission orders nine firms to disclose personalized pricing and pay data
The FTC has subpoenaed nine food‑delivery, airline and ride‑sharing companies to provide detailed information on how personal data drives consumer pricing and employee compensation.
1 source · trade press
HIPAAHighEnforcement action1 day ago
GoodRx and Criteo settle data breach class action for $32 million
A court approved a revised settlement of $32 million between GoodRx and Criteo to end a class‑action lawsuit over a data breach.
1 source · trade press
CCPAHighRule change1 day ago
California extends CMIA protections to health care chatbots and adds AI guardrails
AB 1979, signed into law on 29 October 2026, expands the Confidentiality of Medical Information Act to cover consumer‑facing chatbots and restricts AI use in clinical decision‑making.
1 source · trade press
NIST CSFBreach report1 day ago
Department of Homeland Security breach exposes over 41,000 employee records
A leak of more than 41,000 DHS employee personal and work details was traced to a compromised Okta single sign‑on system earlier this year.
1 source · trade press
GDPRHighEnforcement action1 day ago
French data protection authority fines Fnac Darty €7 million over illegal mobile app tracking
CNIL fined Fnac Darty €7 million for using third‑party trackers in its mobile app without user consent; a daily penalty of €10,000 applies if the decision is not complied with.
1 source · trade press
GDPRHighEnforcement action1 day ago
ICO reprimands Staffordshire Police over domestic abuse breach
The Information Commissioner’s Office issued a formal reprimand to Staffordshire Police after a serious breach of personal data relating to domestic abuse victims.
1 source · trade press