The HIPAA Journal

MARCH 26, 2025

According to Sunflower Medical Group, the unauthorized access was identified and blocked on January 7, 2025. The hacker was able to access names, addresses, dates of birth, Social Security numbers, drivers license numbers, medical information, and health insurance information.

Medication

The HIPAA Journal

JULY 8, 2025

On March 22, 2025, Compumedics identified unauthorized access to its network which disrupted the operations of its information technology systems. They confirmed that an unauthorized third party had access to its systems between February 15, 2025, and March 23, 2025, during which time files were copied from its systems.

HIPAA

The HIPAA Journal

MAY 26, 2025

The file review was completed on or around March 26, 2025, and confirmed that the compromised information included names and Social Security numbers. The ransomware attack was detected on March 13, 2025, and the forensic investigation determined on March 17, 2025, that the ransomware group had exfiltrated files from its network.

HIPAA

The HIPAA Journal

JULY 1, 2025

Department of Justice has announced the results of its 2025 National Health Care Fraud Takedown, the largest in its history, eclipsing the previous record of $6 billion with actions to disrupt health care fraud schemes involving more than $14.6 billion in intended losses. They included individuals responsible for $10.6

Tests

The HIPAA Journal

AUGUST 5, 2025

Northwest Radiologists & Mount Baker Imaging Northwest Radiologists and Mount Baker Imaging have provided an update on a data breach first announced in March 2025. The forensic investigation confirmed that there had been unauthorized network access between January 20, 2025, and January 25, 2025.

Medication

The HIPAA Journal

APRIL 16, 2025

The hackers encrypted files and stole data such as names, addresses, telephone numbers, email addresses, dates of birth, demographic information, Social Security numbers, drivers license numbers, medical record numbers, health information, payment information, and health insurance information. Bean of Siri & Glimstad LLP.

Follow-Up

The HIPAA Journal

JULY 21, 2025

Alpha Wellness and Alpha Medical Centre detected unusual network activity on February 3, 2025, and immediately launched an investigation. The compromised information included names, addresses, email addresses, phone numbers, health insurance information, and medical appointment information.

Medication

The HIPAA Journal

APRIL 29, 2025

An investigation was launched, and it was determined on January 21, 2025, that Ascension had inadvertently disclosed patient data to the former business partner, and that data had likely been stolen in the hacking incident.Ascension confirmed that its own systems were unaffected.

Discharges

The HIPAA Journal

APRIL 29, 2025

The OCR breach portal still lists the incident as affecting 112,726 patients and plan members of its HIPAA-regulated entity clients, although that total may well be updated in the coming days. The post Verisource Services Increases Data Breach Victim Count to 4 Million appeared first on The HIPAA Journal.

HIPAA

The HIPAA Journal

JULY 22, 2025

Western Montana Mental Health Center has notified almost 87,000 individuals about a September 2024 cyberattack, and Olde Towne Medical and Dental Center has announced that it fell victim to an Inc Ransom ransomware attack in May 2025. A review of files on the compromised parts of the network was initiated and concluded on May 27, 2025.

Follow-Up

The HIPAA Journal

MAY 26, 2025

The ransomware group obtained names, dates of birth, Social Security numbers, state ID/driver’s license information, health and insurance information, banking information, and biometric data. The settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for August 15, 2025.

HIPAA

The HIPAA Journal

JULY 11, 2025

The files contained names, health insurance information, and diagnostic and/or clinical information. The lawsuit alleged an impermissible disclosure of protected health information in violation of the requirements of the Health Insurance Portability and Accountability Act (HIPAA). The lawsuit – Kaitlyn Hill.

HIPAA

The HIPAA Journal

APRIL 18, 2025

The document review was completed on January 30, 2025, when it was confirmed that the exposed information included first and last names, clinical/treatment information, medical provider names, medical record numbers, and patient account numbers. Notification letters were mailed to the affected individuals two months later, on March 31, 2025.

HIPAA

The HIPAA Journal

MARCH 28, 2025

On March 20, 2025, Pineland Community Service Board disclosed a security incident detected on January 20, 2025. The forensic investigation confirmed unauthorized network access between November 24, 2024, and January 20, 2025, during which time the threat actor viewed or copied information from its network.

Appointments

The HIPAA Journal

JULY 16, 2025

Data compromised in the incident included names, dates of birth, Social Security numbers, passport numbers, driver’s license numbers, medical information, health insurance information, biometric information, usernames/passwords, financial account numbers, and credit/debit card numbers. Million appeared first on The HIPAA Journal.

HIPAA

The HIPAA Journal

MARCH 19, 2025

The Michigan-based aesthetic surgery provider detected unauthorized third-party access to its computer network on January 29, 2025. The exposed data included names, birth dates, Social Security numbers, and health insurance information. Suspicious activity was identified in a single computer on November 20, 2024.

HIPAA

The HIPAA Journal

JULY 8, 2025

The review of the accounts confirmed that they contained names, addresses, dates of birth, financial account information, diagnoses, lab results, medications, treatment information, health insurance and claims information, provider names, dates of treatment, and Social Security numbers.

HIPAA

Valant

JUNE 18, 2025

Behavioral health providers managing both clinical care and business operations face unique challenges: complex prior authorization requirements, extensive documentation standards, and insurance coverage barriers. Insurers denied 19% of in-network claims in 2023 , according to the Kaiser Family Foundation.

Billing

The HIPAA Journal

JULY 9, 2025

The group had access to its network since June 14, 2025, and exfiltrated patient information such as names, addresses, Social Security numbers, dates of birth, driver’s license/state identification card numbers, medical record numbers, treatment information, and health insurance information. A lawsuit – Horvath v. . –

HIPAA

The HIPAA Journal

AUGUST 8, 2025

a provider of risk management, insurance, and financial services, has notified 155,567 individuals about the potential theft of some of their protected health information. The incident was first announced on May 21, 2025, and has recently been reported to the HHS’ Office for Civil Rights.

Insurance

The HIPAA Journal

JULY 10, 2025

The HIPAA Journal has not downloaded any of the leaked data, so cannot confirm the accuracy of the groups’ claims. Arlington Occupational Health and Wellness in Texas was added to the group’s data leak site on July 4, 2025, along with samples of the stolen data and links to the full dataset.

Diagnostics

The HIPAA Journal

MARCH 11, 2025

The data review was completed on February 13, 2025, and confirmed that names, dates of birth, Social Security numbers, medical information, treatment information, healthcare provider information, and health insurance information had been exposed.

HIPAA

The HIPAA Journal

MARCH 24, 2025

in early March 2025.In users of the 23andMe service have a degree of protection under the Genetic Information Nondiscrimination Act (GITA), as their genetic data cannot be used to make employment or health insurance decisions but there may be other ways that their data could be used.

Tests

The HIPAA Journal

MARCH 20, 2025

on February 14, 2025. The intrusion was detected on January 13, 2025, and the investigation confirmed that an unauthorized third party had access to its network between December 8, 2024, and January 11, 2025. Peters, Missouri, has notified 1,265 individuals about a security incident on January 17, 2025.

Hospice

Arkenea

JULY 23, 2025

These sophisticated platforms must navigate an increasingly complex landscape of insurance policies, regulatory requirements, and technological demands while maintaining the highest standards of data security and patient privacy. Advanced systems include claim scrubbing capabilities that identify and correct common errors before submission.

Billing

The HIPAA Journal

JULY 18, 2025

At the start of the month, The HIPAA Journal reported on a cybersecurity incident at Radiology Associates of Richmond, a provider of medical imaging services at seven hospitals in central Virginia and multiple outpatient medical imaging facilities in the state. A network intrusion was detected by the law firm on or around May 6, 2025.

Medication

The HIPAA Journal

MARCH 19, 2025

The breach was detected on January 15, 2025, and immediate action was taken to prevent further unauthorized access. The forensic investigation confirmed that an unauthorized third party accessed the account between January 10, 2025, and January 14, 2025, and potentially viewed or acquired patient data.

HIPAA

The HIPAA Journal

APRIL 29, 2025

In its April 11, 2025, substitute breach notice, Endue Software explained that unauthorized access to some of its systems was identified on February 17, 2025.The The forensic investigation confirmed that an unauthorized actor gained access to some of its systems for a brief period on February 16, 2025.

Hospital

The HIPAA Journal

AUGUST 7, 2025

The ransomware attack prevented access to certain systems, and the forensic investigation confirmed unauthorized access to names, addresses, health insurance information, Social Security numbers, and medical information. The deadline for exclusion from and objection to the settlement is September 12, 2025.

HIPAA

The HIPAA Journal

MAY 31, 2025

The HIPAA Journal reported on the breach on May 19, 2025, the same day six class action lawsuits were filed in federal court in California over the data breach. The affected individuals started to be notified about the data breach on May 9, 2025. More lawsuits are expected to be filed in the coming days.

HIPAA

The HIPAA Journal

AUGUST 6, 2025

The Bianlian hacking group claimed responsibility for the attack and gained access to names, Social Security numbers, addresses, dates of birth, driver’s license numbers, medical record numbers, health insurance information, billing information, and limited treatment information.

HIPAA

The HIPAA Journal

JULY 22, 2025

Complimentary credit monitoring and credit score services were offered to the affected individuals, who were notified by mail in February 2025. All class members may submit a claim for two years of credit monitoring services, which include a $1,000,000 identity theft insurance policy.

HIPAA

Physicians Practice

JULY 24, 2025

According to the National Association of Insurance Commissioners, around 110,000 malpractice claims will be filed in the U.S. They will notify your malpractice insurance carrier. Avoid discussing the incident with anyone outside your insurer or assigned defense attorney — including colleagues, staff, or even the patient’s family.

De-Escalation

The HIPAA Journal

APRIL 1, 2025

A comprehensive and time-intensive review of the affected accounts was recently concluded, and it was confirmed that names, addresses, Social Security numbers, drivers license numbers, bank account information, payment card information, dates of birth, medical information, and health insurance information were stored in the accounts.

HIPAA

The HIPAA Journal

AUGUST 7, 2025

The review was completed on June 6, 2025, and confirmed that Premier Dermatiology Partners’ data was present in the compromised accounts. Many of the healthcare providers affected by the Oracle Health incident issued notifications shortly after being notified about the January 22, 2025, hacking incident.

Business Associate

The HIPAA Journal

JULY 7, 2025

According to the filing, a breach of its IT systems was detected on June 5, 2025, which rendered certain IT systems and data unavailable. Surmotics holds a cyber insurance policy and anticipates that the policy will cover a significant percentage of any expenditures, not including the deductible and certain exclusions.

Hospital

The HIPAA Journal

APRIL 1, 2025

All claims must be submitted by or be postmarked by June 30, 2025. The settlement has received preliminary approval from the court, and the final approval hearing has been scheduled for June 16, 2025. Million Data Breach Settlement appeared first on The HIPAA Journal. The post Azura Vascular Care Agrees to $3.15

HIPAA