Government Initiative Provides Free Cybersecurity Upgrades and Security Services to Rural Hospitals
Small and rural healthcare providers lack the resources they need to make essential improvements to their information security programs to defend against cyberattacks. One of the biggest criticisms of the proposed update to the HIPAA Security Rule was the cost of implementation, especially for small, rural, and other underserved healthcare providers, who simply do not have the spare funds to make the required improvements or, in many cases, the staff to implement them.
While the proposed HIPAA Security Rule update attracted considerable criticism, a healthcare cybersecurity bill was unanimously passed by the Senate that calls for Congress to provide grants to underserved hospitals to help them make vital improvements to cybersecurity. The bill has been sent to the House; however, if it is passed and is signed into law by the President, Congress would need to approve the funding, so it could be many months before any grants are made available.
Some help may be on the way for rural hospitals in the meantime. On Monday, the White House Office for the National Cyber Director (ONCD) announced the Project Lifeline 250 initiative. Similar to the Project Watershed 250 project announced in Texas in late August to help state water and wastewater companies implement cybersecurity tools, Project Lifeline 250 is a pilot program to help rural hospitals make essential upgrades to cybersecurity, such as replacing vulnerable legacy systems that are easy targets for cybercriminals.
Project Lifeline 250 is a six-month pilot program that will provide free hardware upgrades and cybersecurity services to rural hospitals through partnerships with IT and cybersecurity companies such as Abnormal AI, Cisco, Cyera, Forescout Technologies, Infoblox Security Solutions, Microsoft, Palo Alto Networks, ServiceNow, Trelix, and Zscaler. Those companies have agreed to provide hardware and services to rural hospitals in South Carolina, allowing them to upgrade basic cybersecurity defenses free of charge. They include providing assistance with the identification and upgrading of vulnerable legacy technology, implementing AI-powered detection and response services, and providing backup drives to help the hospitals maintain critical services in the event of a cyberattack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Similar to the Project Watershed 250 initiative, Project Lifeline 250 will be tested in a single state before a planned nationwide rollout. “Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical backup devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” said South Carolina Governor Henry McMaster, at the launch of the initiative at Newberry Health on Monday. While the announcement has been made, it was light on detail. It is unclear when the initiative will commence or how it will be funded if it is rolled out nationwide.
The post Government Initiative Provides Free Cybersecurity Upgrades and Security Services to Rural Hospitals appeared first on The HIPAA Journal.
University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack – The HIPAA Journal
University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack
The University of New Mexico Health System (UNM Health) has experienced a cyberattack that has prevented access to critical electronic systems. The incident was detected on October 26, 2026, and as a precaution to ensure patient safety, all ambulance traffic was temporarily diverted to alternative hospitals. A decision was made to cancel all appointments at UNM Health facilities on October 26. UNM Health explained in a 2:30 p.m. update on October 26 that it was also temporarily limiting the acceptance of new patients while efforts continued to restore access to key systems.
Other health systems in Albuquerque and Santa Fe have been working with UNM Health to ensure that patients receive the care they need. UNM Health operates UNM Hospital in Albuquerque, the only level 1 trauma center in New Mexico, so the cyberattack had the potential to place patient safety at serious risk. According to UNM Health’s announcement, the incident caused a system outage that affected the entire University of New Mexico Health Sciences Center. On October 26, all students at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health were requested to leave the campus, and classes were also cancelled on Tuesday.
UNM Health was able to quickly start restoring access to systems, and confirmed in a 10:27 p.m. update that all UNM Health hospitals remain open, and clinics would resume regularly scheduled appointments on October 27, 2026. In the early hours of October 27, 2026, UNM Health confirmed that critical systems had been brought back online at The University of New Mexico Health Sciences Center, and ambulance traffic had returned to normal operations. The divert lasted from 12:30 to 2:30 p.m. on October 26. UNM Health said the cancellation of appointments and outpatient surgeries was necessary while IT teams worked to protect the network.
Containment efforts began at around 11 a.m. on October 26, which were largely successful. While some end user devices were impacted, UNM was able to prevent the threat actor from reaching its core systems and servers. External cybersecurity partners assisted with the remediation efforts, and an investigation has been launched to assess the nature and scope of the unauthorized access.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Law enforcement has been notified, and the incident is under criminal investigation, so limited information about the nature of the attack can be disclosed at this time. It is naturally too early to determine the extent to which patient data was involved. While UNM Health has not disclosed details about the nature of the attack, this appears to have been an attempted ransomware attack. A new ransomware group called Byod has claimed it was responsible. The group’s data leak site currently lists 10 victims.
The group’s post about the attack suggests that 36,000 systems at the UNM main campus and UNM Health were compromised, and that patient, student, and employee data was exfiltrated, along with payroll information, internal emails, and Cerner EHR rosters. The group later backtracked to a degree, adding a further post stating it was unaware that “[UNM Health] was running machines related to assisting patients in real-time,” and offered to provide certain decryption keys for free. “(we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only… To any patient that was affected, we will pay you up to $2,500 each for the inconvenience. We are sorry once again. We have morals, and we have a heart, we are not villains, but we will still hold companies responsible for bad security leading to compromise of any customer data.”
The post University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack appeared first on The HIPAA Journal.
Baptist Health Data Breach Settlement Gets First Nod
A class action lawsuit against Baptist Health Medical Center-Drew County has been resolved with a settlement that provides reimbursement for documented losses, compensation for lost time, and credit monitoring services.
Between August 22 and July 8, 2024, a cybercriminal actor had access to the computer systems of Baptist Health Medical Center-Drew County in Arkansas and acquired patients’ personal and protected health information. Data compromised in the incident included names, addresses, birth dates, diagnoses, treatment information, medical record numbers, and other information. The data breach was reported to the HHS Office for Civil Rights as involving the protected health information of 5,207 individuals.
A class action lawsuit was filed in the Pulaski County Circuit Court of Arkansas by plaintiff Latanya Frazier, which was followed by a second putative class action. The two lawsuits were consolidated into a single complaint – Latanya Frazier & Chanta Ringo v. Baptist Health – as they made similar claims. The consolidated lawsuit is pending in the Circuit Court of Lincoln County, Arkansas.
The lawsuit alleged that Baptist Health Medical Center-Drew County maintained patient data in a reckless manner, as information was stored on computer systems vulnerable to cyberattacks and there was insufficient monitoring for signs of intrusions. The lawsuit claimed the lack of appropriate safeguards and failure to follow industry-standard cybersecurity practices violated HIPAA. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment, and invasion of privacy.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Baptist Health Medical Center-Drew County denies wrongdoing and disagrees with all claims and contentions in the lawsuit, while the plaintiffs believe their claims are valid. All parties agreed to engage in negotiations to ensure an early resolution of the lawsuit, and an appropriate settlement was agreed upon that was acceptable to all parties. The settlement has recently received preliminary approval from the court, and the final fairness hearing has been scheduled for February 4, 2027.
Baptist Health Medical Center-Drew County has agreed to pay attorneys’ fees and expenses, settlement administration and notice costs, service awards for the two class representatives, and benefits for the class members. All class members are entitled to claim two years of single-bureau credit monitoring services, which include a $1 million identity theft insurance policy. Class members may also claim up to four hours of lost time at $20 per hour as compensation for the time spent responding to the data incident.
In addition, class members who incurred losses as a result of the incident may submit a claim for reimbursement of those losses. Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred between April 22, 2024, and December 8, 2026. Individuals who experienced fraud or identity theft as a result of the incident may also submit a claim for reimbursement of documented, unreimbursed extraordinary losses up to $4,000 per class member. Individuals wishing to object to the settlement or exclude themselves must do so by November 9, 2026. The deadline for submitting a claim is December 8, 2026.
The post Baptist Health Data Breach Settlement Gets First Nod appeared first on The HIPAA Journal.
HIPAA-eligible services nudge enterprises toward compliance – TechTarget
HHS Delegates Permissive Exclusion Authority to CMS – The HIPAA Journal
HHS Delegates Permissive Exclusion Authority to CMS The HIPAA Journal
HHS Delegates Permissive Exclusion Authority to CMS
The Department of Health and Human Services (HHS) Office of Inspector General (OIG) is responsible for excluding individuals and entities from participation in federal healthcare programs; however, that responsibility is now shared with the HHS Centers for Medicare and Medicaid Services (CMS). The move is intended to improve the ability of the HHS to investigate and prosecute individuals and entities suspected of healthcare fraud.
On October 14, 2026, HHS published a notice in the Federal Register formally delegating partial exclusion responsibility to CMS with immediate effect. The authority of HHS-OIG remains unchained, and it will retain sole responsibility for imposing mandatory exclusions. “As the agency directly responsible for administering Medicare and Medicaid, CMS is uniquely positioned to investigate, identify, and develop the evidentiary basis underpinning permissive exclusion determinations,” explained HHS Secretary Robert F. Kennedy, Jr. “Formalizing this delegation aligns investigative and enforcement responsibilities within a single operating division, reducing redundancy and improving program integrity outcomes.”
The CMS already had administrative enforcement authority related to Medicare and Medicaid program providers and suppliers; its authority has been expanded to include any individual or entity. The expanded authority does not cover conducting hearings or promulgating regulations, and the authority will be in line with existing HHS-OIG policies, procedures, and regulations. While the authority takes immediate effect, some of the details still need to be fleshed out, such as how the CMS will coordinate with HHS-OIG and the Department of Justice, and how individuals and entities should respond to exclusion proceedings initiated by CMS.
Under Section 1128 of the Social Security Act, mandatory exclusions from federal healthcare programs are required by law if certain criteria are met and are generally for a minimum of five years unless an individual or entity has previously been excluded from participation. Mandatory exclusions are typically required by law for healthcare fraud convictions related to Medicare, Medicaid, the State Children’s Health Insurance Program, or other State health care programs; felony convictions for other healthcare-related fraud; felony convictions related to controlled substances; and criminal convictions related to patient abuse or neglect.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The HHS can also impose permissive exclusions, as authorized by Section 1128(b) of the Social Security Act. These exclusions are discretionary and are often imposed for misdemeanor convictions, such as financial misconduct; the submission of false claims under the Anti-Kickback Statute; and the suspension or revocation of a license by a state licensing authority. Depending on the nature of the grounds for exclusion, there may be no minimum or maximum exclusion, although permissive exclusions are generally shorter than mandatory exclusions.
Regardless of the reason for exclusion, federal healthcare programs such as Medicare and Medicaid cannot pay for goods or services provided by an excluded individual or entity. All exclusions are made public via the HHS-OIG List of Excluded Individuals/Entities (LEIE). Entities that bill federal healthcare programs for goods or services provided by an excluded individual or entity face stiff financial penalties and must regularly check the HHS-OIG Exclusion List.
The post HHS Delegates Permissive Exclusion Authority to CMS appeared first on The HIPAA Journal.
Ransomware Incident at Paylogix Affects 41K Individuals – The HIPAA Journal
Ransomware Incident at Paylogix Affects 41K Individuals The HIPAA Journal