HHS Delegates Permissive Exclusion Authority to CMS

Posted by Steve Alder

The Department of Health and Human Services (HHS) Office of Inspector General (OIG) is responsible for excluding individuals and entities from participation in federal healthcare programs; however, that responsibility is now shared with the HHS Centers for Medicare and Medicaid Services (CMS). The move is intended to improve the ability of the HHS to investigate and prosecute individuals and entities suspected of healthcare fraud.

On October 14, 2026, HHS published a notice in the Federal Register formally delegating partial exclusion responsibility to CMS with immediate effect. The authority of HHS-OIG remains unchained, and it will retain sole responsibility for imposing mandatory exclusions. “As the agency directly responsible for administering Medicare and Medicaid, CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations,” explained HHS Secretary Robert F. Kennedy, Jr. “Formalizing this delegation aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes.”

The CMS already had administrative enforcement authority related to Medicare and Medicaid program providers and suppliers; its authority has been expanded to include any individual or entity. The expanded authority does not cover conducting hearings or promulgating regulations, and the authority will be in line with existing HHS-OIG policies, procedures, and regulations.  While the authority takes immediate effect, some of the details still need to be fleshed out, such as how the CMS will coordinate with HHS-OIG and the Department of Justice, and how individuals and entities should respond to exclusion proceedings initiated by CMS.

Under Section 1128 of the Social Security Act, mandatory exclusions from federal healthcare programs are required by law if certain criteria are met and are generally for a minimum of five years unless an individual or entity has previously been excluded from participation. Mandatory exclusions are typically required by law for healthcare fraud convictions related to Medicare, Medicaid, the State Children’s Health Insurance Program, or other State health care programs; felony convictions for other healthcare-related fraud; felony convictions related to controlled substances; and criminal convictions related to patient abuse or neglect.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The HHS can also impose permissive exclusions, as authorized by Section 1128(b) of the Social Security Act. These exclusions are discretionary and are often imposed for misdemeanor convictions, such as financial misconduct; the submission of false claims under the Anti-Kickback Statute; and the suspension or revocation of a license by a state licensing authority. Depending on the nature of the grounds for exclusion, there may be no minimum or maximum exclusion, although permissive exclusions are generally shorter than mandatory exclusions.

Regardless of the reason for exclusion, federal healthcare programs such as Medicare and Medicaid cannot pay for goods or services provided by an excluded individual or entity. All exclusions are made public via the HHS-OIG List of Excluded Individuals/Entities (LEIE). Entities that bill federal healthcare programs for goods or services provided by an excluded individual or entity face stiff financial penalties and must regularly check the HHS-OIG Exclusion List.

The post HHS Delegates Permissive Exclusion Authority to CMS appeared first on The HIPAA Journal.

Ransomware Incident at Paylogix Affects 41K Individuals

Posted by Steve Alder

Data breaches have been announced by Paylogix, the Kenaitze Indian Tribe, the Center for Bone and Joint Surgery of the Palm Beaches, and Wichita Family Dental.

Paylogix, New York

Paylogix LLC, a New York-based third-party administrator and software-as-a-service provider, whose solutions are used for enrollment, billing, and managing voluntary employee benefits, has notified the HHS Office for Civil Rights (OCR) about a breach of the protected health information of 41,739 individuals.

Paylogix explained in its breach notification letter that it experienced a network disruption involving certain computer systems and services. The forensic investigation determined that an unauthorized third party had access to its computer network from November 13, 2025, to November 18, 2025. During that time, files containing personal and protected health information were accessed and copied from its network.

The review of the affected files was recently completed. Paylogix determined that the exposed data included dates of birth, Social Security numbers, and voluntary benefit information. A subset of individuals also had their access credentials, electronic signatures, financial account information, health insurance information, medical information, passport numbers, taxpayer identification numbers, and/or U.S. alien identification numbers compromised in the incident. While not mentioned in the notification letters, this appears to have been a ransomware attack by the Akira ransomware group, which claimed to have exfiltrated 185 GB of data.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The Kenaitze Indian Tribe, Alaska

The Kenaitze Indian Tribe in Alaska has notified 9,319 individuals about a data security incident that exposed some of their protected health information. Suspicious activity was identified within its network on July 27, 2026. The investigation concluded that an unauthorized third party had access to its network between July 16, 2026, and July 27, 2026. During that time, files on the compromised parts of the network may have been accessed or acquired.

The review of the affected data was recently completed, and it has been confirmed that the exposed data includes first and last names, dates of birth, Social Security numbers, driver’s license numbers/state IDs, financial account numbers, health insurance information, and medical information. The affected individuals started to be notified on September 25, 2026.

Center for Bone and Joint Surgery of the Palm Beaches, Florida

Center for Bone and Joint Surgery of the Palm Beaches in Florida has notified the HHS’ Office for Civil Rights about a breach of the protected health information of 5,461 individuals. On July 27, 2026, suspicious activity was identified on its website. The investigation determined that certain forms on its website may have been compromised, potentially allowing an unauthorized third party to obtain data associated with those forms. While data was exposed, the investigation found no proof that patient data was obtained or misused.

The data review determined that the exposed information included names, contact information, appointment request information, and information voluntarily provided through website forms.  The affected forms have been removed from its website, security has been strengthened, and additional security measures have been implemented to reduce the risk of similar incidents in the future.

Wichita Family Dental, Kansas

Wichita Family Dental, a dental practice with locations in Wichita and Derby, Kansas, has identified unauthorized access to an employee’s email account. The unauthorized access was identified on or around May 4, 2026. The account has been secured, and the investigation and review of the account were completed on July 6, 2026.

The account was found to contain the personal and protected health information of 1,273 individuals. The data involved included names, addresses, dates of birth, Social Security numbers, driver’s license numbers/state ID numbers, taxpayer ID numbers, payment card information, financial account information, health insurance information, and dental records. Steps have been taken since the incident to improve email security.

The post Ransomware Incident at Paylogix Affects 41K Individuals appeared first on The HIPAA Journal.

Brockton Neighborhood Health Center to Pay Up to $850,000 to Settle Breach Lawsuit

Posted by Steve Alder

Massachusetts-based Brockton Neighborhood Health Center has agreed to pay up to $825,000 to settle class action litigation over a 2024 cyberattack and data breach that affected 97,488 individuals. The data breach that sparked the lawsuits was identified on November 3, 2024. The forensic investigation confirmed that an unauthorized third party accessed its network between November 1 and November 3, 2024. That third party was a ransomware group called Interlock, which obtained files containing patient information such as names, addresses, dates of birth, diagnoses/conditions, lab test results, medications, other treatment information, medical record numbers, and health insurance information.

Multiple class action lawsuits were filed in response to the data breach, alleging that the data breach could have been prevented and occurred as a result of cybersecurity failures. The lawsuits were consolidated into a single complaint – Howard, et al. v. Brockton Neighborhood Health Center, Inc. – which is pending in the Plymouth County Superior Court for the Commonwealth of Massachusetts.

The consolidated lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment, and invasion of privacy. Brockton Neighborhood Health Center maintains there was no wrongdoing and disagrees with all claims and contentions in the lawsuit. After weighing up the risks and uncertainties of continued litigation, all parties agreed to a settlement.

Brockton Neighborhood Health Center has agreed to pay attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives. An $850,000 settlement fund has been established to cover those costs and pay benefits to the class members. All class members may claim three years of credit monitoring services. A claim may also be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $2,500 per class member. An alternative cash payment of up to $50 per class member may be claimed if a reimbursement claim is not filed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The settlement has received preliminary approval from the court. The deadline for objection is November 9, 2026, and claims must be submitted by December 8, 2026. The final fairness hearing has been scheduled for January 12, 2027.

The post Brockton Neighborhood Health Center to Pay Up to $850,000 to Settle Breach Lawsuit appeared first on The HIPAA Journal.

Data Breach Announced by NorthShore Health Centers

Posted by Steve Alder

NorthShore Health Centers, a nonprofit healthcare provider serving patients in Porter, Lake, La Porte, and Jasper Counties in Northwest Indiana, has warned patients about a cybersecurity incident that exposed some of their personal and protected health information.

According to its October 14, 2026, website notice about the data privacy event, the incident was first detected on August 10, 2026. An investigation was launched into suspicious network activity, with assistance provided by third-party cybersecurity and digital forensics experts. The investigation determined that an (unnamed) unauthorized third party had access to parts of its IT environment between August 10, 2026, and August 11, 2026, and potentially viewed or obtained files containing patient information.

The investigation and data review are ongoing as of October 14, 2026, so the number of affected individuals has not yet been confirmed. The types of information involved are still being assessed; however, it is likely that names, Social Security numbers, information related to medical treatments and conditions, and health insurance information were involved.

NorthShore Health Centers said it will mail notification letters to the affected individuals when the data review is concluded. Current and former patients should be aware that a ransomware group called Insomnia has claimed responsibility for the incident. The group added NorthShore Health Centers to its dark web data leak site and threatened to publish the stolen data if a ransom was not paid; it then proceeded to leak the stolen data. The HIPAA Journal has not downloaded any of the leaked data; however, the file tree suggests that patient data is likely included in the leaked dataset.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

As such, patients should consider placing a fraud alert and credit freeze with one of the three major credit reporting agencies and should carefully monitor their accounts and explanation of benefits statements for signs of data misuse. If data misuse is suspected, it should be promptly reported to the relevant institution (bank, insurer, etc.).

The post Data Breach Announced by NorthShore Health Centers appeared first on The HIPAA Journal.