Framework
Health Insurance Portability and Accountability Act
24 stories in the last 90 days≈ $131M in fines tracked (8 actions)Next deadline 19 Dec 2026Latest story 8 hours ago
Official text: HHS: HIPAA
Lehigh Valley Health Network agreed to pay an $800,000 civil penalty to resolve alleged HIPAA privacy and security violations identified by the Office for Civil Rights.
1 source · trade press
A court approved a revised settlement of $32 million between GoodRx and Criteo to end a class‑action lawsuit over a data breach.
1 source · trade press
The FTC filed a lawsuit against telehealth provider Him & Hers alleging deceptive marketing and unlawful handling of consumer health data.
1 source · trade press
The U.S. Department of Health and Human Services’ Office for Civil Rights disclosed that Blueberry Pediatrics suffered a data security incident exposing the protected health information of 341,000 patients.
1 source · trade press
The HHS Office of Inspector General has transferred permissive exclusion authority to the Centers for Medicare & Medicaid Services, enabling CMS to issue exclusions for HIPAA violations.
1 source · trade pressThe Office of the National Coordinator reduced 14 certification criteria and revised seven in the HTI‑5 rule, while postponing decisions on information‑blocking requirements.
Brockton Neighborhood Health Center agreed to a settlement of up to $825,000 for a 2024 data breach affecting patient records.
1 source · trade press
NorthShore Health Centers disclosed a breach of protected health information on 27 October 2026 affecting patients in four Indiana counties.
1 source · trade press
Federal regulators reversed a proposal to eliminate core privacy and security certification rules for electronic health records after industry pushback.
1 source · trade press
Denver Health Medical Plan disclosed a vendor data breach on 26 October 2026 that exposed personal information of over 238,000 members.
1 source · trade press
Washington Gastroenterology will pay $4.6 million to settle a class‑action over a cyber breach identified earlier this year.
1 source · trade press
UltraMobile Imaging disclosed a breach affecting 75,000 people, announced alongside incidents at Artistic Smiles and Parkview Health on 23 October 2026.
1 source · trade press
Quest Diagnostics told the SEC a cyberattack may have exposed patient health information, disclosed on 23 October 2026.
On 23 October 2026 a Manhattan law firm disclosed that PHI of 196,645 patients was exposed in a breach.
1 source · trade press
Ridgeway Pharmacy in Montana disclosed a breach on 22 October 2026 that exposed personal health information of nearly 259,000 individuals.
1 source · trade press