Ridgeway Pharmacy Data Breach Affects 259,000 Individuals – The HIPAA Journal
Ridgeway Pharmacy Data Breach Affects 259,000 Individuals The HIPAA Journal
Ridgeway Pharmacy Data Breach Affects 259,000 Individuals
A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by IMS Care Center in Arizona and Persona Dental in Minnesota.
Ridgeway Pharmacy
Ridgeway Pharmacy Ltd, a Victor, Montana-based mail order and community pharmacy, has identified a data security incident involving its website that exposed the personal and protected health information of 258,920 of its customers.
Ridgeway Pharmacy said that on August 21, 2026, it became aware that personal information had been exposed via its third-party designed and developed website. An investigation was launched to determine the extent of the unauthorized access, with assistance provided by third-party digital forensics experts. They confirmed that the incident was limited to its website, and no internal systems were involved. Data potentially compromised in the incident included names, addresses, dates of birth, prescription information, health information, and insurance information. A subset of individuals also had payment card information exposed.
In response to the incident, Ridgeway Pharmacy has reviewed its third-party website maintenance and data security arrangements and has implemented additional security protections to prevent similar incidents in the future. They include switching to a new website platform, restricting access, and strengthening monitoring. As a precaution against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
IMS Care Center
IMS Care Center, a Phoenix, Arizona-based physician-owned multi-specialty medical practice, has identified unauthorized access to its email environment. Suspicious activity was identified on June 18, 2026. Its email system was secured, and an investigation was launched to determine the nature and scope of the unauthorized activity.
The investigation confirmed that an unauthorized third party accessed its email system between June 17, 2026, and June 18, 2026. The affected email accounts were reviewed, and on September 30, 2026, IMS Care Center confirmed that patient names, addresses, Social Security numbers, and medical information had been exposed. Notification letters were mailed to the affected individuals on October 16, 2026, and at least 12 months of complimentary credit monitoring and identity theft protection services have been offered to the affected individuals.
IMS Care Center said several steps have been taken to improve email security, including implementing new technical safeguards, Sophos MDR, geographical restrictions on email access, enhanced phishing training for the workforce, updated data privacy and security policies and procedures, and it has committed to periodic technical and nontechnical evaluations. The incident has been reported to state attorneys general and the HHS’ Office for Civil Rights; however, it has yet to be added to the OCR breach portal, so it is unclear how many individuals have been affected.
Persona Dental
Persona Dental, a Sartell, Minnesota-based family and cosmetic dental practice, has announced a data security incident that has affected 3,386 current and former patients. Suspicious activity was identified within its computer network on or around April 30, 2026. The forensic investigation determined that its network had been accessed by an unauthorized third party between April 28, 2026, and April 30, 2026.
Its network was secured, and additional security measures have been implemented to prevent similar incidents in the future. The review of the affected files has recently been completed, and it has been confirmed that patient data such as names, dates of birth, diagnosis and treatment information, and health insurance information were involved. For certain patients, Social Security numbers were involved. Notification letters started to be mailed to the affected individuals on September 9, 2026, and individuals who had their Social Security numbers exposed have been offered complimentary credit monitoring services.
The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals appeared first on The HIPAA Journal.
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation – The HIPAA Journal
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation The HIPAA Journal
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation
American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data. The data breach sparked multiple lawsuits, which were consolidated – In re American Renal Management LLC Data Breach Litigation – in the U.S. District Court for the Middle District of Tennessee. A $900,000 settlement has recently been proposed to resolve the litigation.
The data breach that sparked the litigation was identified on February 29, 2024. The forensic investigation determined that its network had been accessed by an unauthorized third party between February 21, 2024, and March 1, 2024, and files containing patient information were copied. The files contained a wide range of personal and protected health information, including names, contact information, birth dates, Social Security numbers, driver’s license numbers, financial account information, health insurance information, billing and claims information, medical information, and more.
The affected individuals started to be notified on February 14, 2025, almost a year after the intrusion was first identified. The HHS was notified on April 29, 2024, using a placeholder figure of at least 501 affected individuals. That total has not been updated since it was initially reported. According to the lawsuit, the defendant notified 59,400 living individuals that they had been affected.
The consolidated complaint names five plaintiffs, who allege that the defendant was at fault for the cyberattack due to the failure to implement reasonable and appropriate cybersecurity measures. The lawsuit also claims that the defendant unreasonably delayed issuing notification letters, depriving the affected individuals of the opportunity to take steps to protect themselves against identity theft and fraud. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Consumer Privacy Act and California Unfair Competition Law.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Innovative Renal Care denies all claims and contentions in the lawsuit, including wrongdoing and liability; however, mediation was successful, and a settlement was agreed. The $900,000 settlement fund will be used to pay attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and the remainder will be used to pay benefits to the class members.
Class members may submit a claim for reimbursement of up to $5,000 for documented, unreimbursed losses due to the data breach and/or claim a pro rata cash payment, estimated to be $100 per class member but may be higher or lower depending on the number of claims submitted. The deadline for opting out of the settlement and filing an objection is November 20, 2026. Claims must be submitted by December 21, 2026, and the final fairness hearing has been scheduled for February 1, 2027.
The post Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation appeared first on The HIPAA Journal.
HHS Confirms HIPAA Penalties Will Not Be Adjusted for Inflation This Year
This week, the Department of Health and Human Services (HHS) has confirmed via the Federal Register that it will not be applying an annual inflation multiplier in 2026 and will continue to use the civil monetary penalty levels for 2025.
The Federal Civil Penalties Inflation Adjustment Act of 1990, later amended by the Federal Civil Penalties Inflation Adjustment Act Improvement Act of 2015, requires federal agencies to apply annual increases to their penalty structures in line with inflation to ensure that civil monetary penalties continue to serve as an effective deterrent. The annual inflation multiplier is set by the Office of Management and Budget (OMB).
With respect to HIPAA, penalties were established by the HITECH Act of 2009, which set a maximum penalty of $1,500,000 per violation, per year. Were it not for the annual increases, the penalty amounts would become less effective over time. Currently, the maximum penalty for a HIPAA violation is $2,190,294, an increase of 46% from the level set by the HITECH Act 17 years ago.
The decision was not made by the HHS; rather, it is due to the lengthy government shutdown last Fall. As a result of that extended shutdown, the Bureau of Labor Statistics (BLS) was unable to produce the necessary data to calculate an inflation multiplier for 2026. The government shutdown occurred due to partisan deadlock in Congress, which resulted in a lapse in fiscal year 2026 appropriations ahead of the October 1 deadline. The Bureau of Labor Statistics was unable to produce the necessary Consumer Price Index (CPI-U) data for October 2025, which is required to calculate the 2026 cost-of-living adjustment multiplier. The OMB Director issued a memorandum in April 2026, informing federal agencies that the annual inflation adjustment for 2026 had been cancelled, and federal agencies should continue to use their current penalty structures.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The HHS Office for Civil Rights has been pushing Congress to increase the civil monetary penalties for HIPAA violations from the levels set by the HITECH Act. While the lack of an inflation adjustment this year may weaken the deterrent effect, the inflation multiplier for 2027 will take into account the cost-of-living increases from 2025 to 2027.
The post HHS Confirms HIPAA Penalties Will Not Be Adjusted for Inflation This Year appeared first on The HIPAA Journal.
Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon Emergency Medical Services, LLC (Fallon). Lifeline and Fallon were acquired by another Massachusetts operator in 2022, when Transformative Healthcare ceased operations.
The settlement agreement also resolves allegations that Fallon and Lifeline upcoded claims to MassHealth by billing for more expensive levels of service than they provided, including billing for emergency services when nonemergency level services were provided, and submitting false claims for Advanced Life Support services when the services provided did not meet the criteria for Advanced Life Support services. Under the proposed consent judgment, the combined allegations have been resolved with a $1,000,000 financial penalty, which will be paid over five years.
The data security incident was first identified by Fallon on April 21, 2023. The forensic investigation confirmed that systems containing the data of Transformative Healthcare patients and employees were accessed by an unauthorized third party between February 17, 2023, and April 21, 2023, during an archiving process. During that time, the personal and protected health information of 750,116 Massachusetts residents was exposed and potentially stolen. The impacted data included names, contact information, dates of birth, driver’s license numbers, state identification numbers, Social Security numbers, medical information, and health insurance information.
The Massachusetts Attorney General launched an investigation into the data breach to assess compliance with the Massachusetts Consumer Protection Act, Massachusetts Data Security Law, and HIPAA. The fraud investigation was handled separately. The Massachusetts Attorney General determined that Transformative Healthcare had failed to maintain an appropriate written information security program, and concluded that Transformative Healthcare and Fallon violated the Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164, Subpart A (General Provisions of HIPAA), Subpart C (Security Standards for the Protection of Electronic Protected Health Information of the HIPAA Security Rule), and Subpart E (Privacy of Individually Identifiable Health Information of the HIPAA Privacy Rule).
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
In addition to the financial penalty, the settlement requires Transformative Healthcare and Fallon to ensure compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules, and includes the requirement to destroy personal information and protected health information within 45 days of the effective date of the consent judgment.
“Healthcare companies have a responsibility to protect the sensitive patient data they are entrusted with and to bill MassHealth only for the services they provide,” said Massachusetts Attorney General Andrea Joy Campbell. “My office will continue to hold companies accountable when they defraud MassHealth and put residents’ personal information at risk.”
The post Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare appeared first on The HIPAA Journal.