Senate Bill Seeks to Expand Use of AI Technologies in Healthcare and Reimburse for Adoption
A legislative discussion draft has been introduced in the Senate that seeks input from industry stakeholders, clinicians, and policy experts on expanding the use of AI tools in healthcare, while ensuring transparency, patient safety, and compliance with data privacy and security laws. The bill seeks to develop a more predictable and consistent framework for review of AI technologies and establish a reimbursement pathway for adoption of AI-based tools in healthcare.
The bill, the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care (PATIENT AI) Act, was introduced by Senate HELP Committee chair, Senator Dr. Bill Cassidy (R-LA). The bill calls for the U.S. Department of Health and Human Services to engage a nonprofit organization to examine and develop recommendations concerning liability related to AI-based applications in healthcare settings and identify any potential issues. The Comptroller General should produce a report examining public proposals for establishing transparency and explainability measures for the development, validation, use, and deployment of healthcare AI applications
The bill requires the HHS to expand the use of AI within the department to improve the efficiency of internal operations as well as healthcare outcomes, and should work with the Director of the National Institute of Standards and Technology (NIST) and healthcare and public health sector stakeholders to develop materials for training healthcare and public health sector entities on the best uses of AI-based applications in healthcare. The HHS Chief Information Officer (CIO) is instructed to build datasets to be used to support health care research using artificial intelligence-based applications.
Responsibilities have been proposed for the Food and Drug Administration concerning reviews of integrated devices, software-based devices, third-party reviews and certification, postmarket surveillance, applying medical device product liability laws to integrated and software-based devices, and it is required to develop a rolling process for AI software reviews.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The Office of the National Coordinator for Health Information Technology (ONC) should work with agencies within the HHS to provide technical assistance with implementing AI tools within each agency, and expand Certified Health Information Technology to include clinical research technology, and AI-based applications not considered to be FDA-regulated devices. The HHS Secretary is instructed to create a coverage evaluation framework for artificial intelligence-based services, develop payment methodologies to reimburse for AI-based services, and AI-based applications that deliver care autonomously.
“We’re living in a new digital age as artificial intelligence transforms how we deliver care,” said Sen. Cassidy. “Implementing AI in health care must be done responsibly and to the benefit of patients, innovators, and consumers. This discussion draft proposes solutions to expand access to AI-based technologies by creating regulatory predictability while prioritizing patient safety.”
The post Senate Bill Seeks to Expand Use of AI Technologies in Healthcare and Reimburse for Adoption appeared first on The HIPAA Journal.
Data Breaches Announced by HCA Healthcare; Blossom Health
Data breaches have been announced by HCA Healthcare, Blossom Health, El Camino Health, and University of Mississippi Medical Center.
HCA Healthcare Inc.
Nashville, Tennessee-based HCA Healthcare Inc., the operator of 189 hospitals and approximately 2,600 ambulatory sites of care in 19 U.S. states, has disclosed a cybersecurity incident that was first identified on August 12, 2026. Patient and employee data were compromised in the incident.
Suspicious activity was identified within certain IT systems, and the forensic investigation confirmed unauthorized access to those systems on August 12, 2026. HCA Healthcare confirmed that the threat actor obtained copies of certain HR files containing medical resident personal information. The review of the impacted files confirmed that they contained information related to employment, including name, date of birth, email address, phone number, Social Security number, and immigration information.
Patient data was also compromised related to certain affiliated facilities and physician offices. Patient data exposed in the incident included names, email addresses, phone numbers, dates of birth, Social Security numbers, medical information, and health insurance information. The number of affected patients has yet to be disclosed, although 15,096 Texas residents are known to have been affected. The affected individuals have been offered two years of complimentary credit monitoring services.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Blossom Health
Blossom BH Opco Inc., an online telepsychiatry and virtual mental health provider that does business as Blossom Health, has started notifying certain patients about an August 2026 data security incident involving unauthorized access to its electronic health record (EHR) software. According to its October 29, 2026, notification letters, an unauthorized actor gained access to the EHR software and patient data via a phishing attack on a non-employee contractor.
The incident has been investigated, and Blossom Health confirmed that the exposed information included names, contact information, and health insurance information. Blossom Health said financial information and Social Security numbers were not accessible. In its website regulatory disclosure, Blossom Health confirmed that the threat actor downloaded a limited number of patient medical records and a user spreadsheet containing patient information.
The unauthorized access has been blocked, user passwords have been changed, and additional technical security measures have been deployed to reduce the risk of similar incidents in the future. As a precaution against identity theft and fraud, the affected individuals have been offered complimentary single-bureau credit report, credit score, and credit monitoring services. The Texas Attorney General was informed that 2,103 Texas residents have been affected, although the total number of affected individuals has yet to be disclosed.
El Camino Health
El Camino Health, a non-profit health system serving Santa Clara County and the Bay Area in California, has confirmed that an unauthorized individual gained access to its Microsoft 365 environment. Suspicious activity was identified on September 1, 2026, and the forensic investigation confirmed unauthorized access to four Microsoft 365 accounts, which were intermittently accessed between August 26, 2026, and September 2, 2026. Certain documents within those accounts were copied or downloaded.
The review of the affected files has been completed, and they were found to contain contact information, demographic information, Social Security numbers, driver’s license numbers, dates of birth, medical record numbers, patient account numbers, diagnoses, treatment information, prescription information, provider names, dates of service, and health insurance information. A subset of patients also had financial account and routing numbers compromised in the incident.
El Camino Health has implemented additional protection and monitoring measures to reduce the risk of similar incidents in the future, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The number of affected individuals has not yet been publicly disclosed.
University of Mississippi Medical Center
University of Mississippi Medical Center (UMMC) has started notifying certain patients about unauthorized access to its computer systems. The unauthorized access was identified on February 19, 2026. Third-party cybersecurity experts were engaged to assist with the investigation, and on October 20, 2026, it was confirmed that its network was subject to unauthorized access between February 11, 2026, and February 19, 2026.
UMMC has reviewed the exposed files, but its notice to the California Attorney General does not include details of the types of data involved or the number of affected individuals. There is currently no substitute data breach notice on the UMMC website. This appears to have been a ransomware attack. The Medusa ransomware group claimed responsibility for the attack in March 2026 and demanded payment to prevent the sale or release of the stolen data. The ransom was not paid.
The post Data Breaches Announced by HCA Healthcare; Blossom Health appeared first on The HIPAA Journal.
HIPAA Cloud Backup for DICOM: 13 Steps, 90 Min [2026] – tech-insider.org
HIPAA Cloud Backup for DICOM: 13 Steps, 90 Min [2026] tech-insider.org
University Hospitals Working on Restoring Systems After Cyberattack – The HIPAA Journal
University Hospitals Working on Restoring Systems After Cyberattack The HIPAA Journal
University Hospitals Working on Restoring Systems After Cyberattack
University Hospitals is working on restoring systems after an October 22 cyberattack. Cybersecurity incidents have also been announced by EyeMed Vision Care and Facial Surgery Group.
University Hospitals
Cleveland, Ohio-based University Hospitals, a 21-hospital health system, is dealing with a cybersecurity incident that was identified on October 22, 2026. University Hospitals activated its incident response protocols and implemented containment measures, which included taking digital services offline, including its MyChart patient portal, while the incident is investigated and mitigated. University Hospitals is still working on safely restoring the affected systems, and in a November 2, 2026, update, confirmed that systems remained offline. A timeline for the restoration of normal business operations cannot be provided.
The health system confirmed that its hospitals, emergency departments, and physician offices remain open, but the incident has disrupted pre-authorizations, and some appointments and elective procedures have had to be rescheduled. The nature of the cyberattack, such as if ransomware was involved, has not been publicly disclosed. No ransomware group appears to have claimed responsibility for the incident. The investigation is ongoing, and University Hospitals has not yet determined the extent to which patient data was involved.
EyeMed Vision Care
EyeMed Vision Care, a Cincinnati, Ohio-based vision insurance provider, has started notifying certain individuals about an email error that resulted in an impermissible disclosure of members’ sensitive information. On September 22, 2026, EyeMed Vision Care sent an email containing member information to an incorrect email address. The incident was the result of human error, was not malicious in nature, and involved a single misdirected email. The email contained information about individuals enrolled in a vision benefit plan managed by EyeMed Vision Care, including names, addresses, dates of birth, Social Security numbers, and membership identification numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The number of affected individuals has not yet been publicly disclosed; however, since the California Attorney General was notified about the data breach, at least 500 California residents have been affected. EyeMed said it has taken steps to prevent similar incidents in the future, including revising its privacy and operations policies and procedures, updating its training program, and retraining appropriate members of its workforce. As a precaution against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services.
Facial Surgery Group
Facial Surgery Group, the operator of five oral and maxillofacial surgery centers in Kansas City, Liberty, Overland Park, and Blue Springs, Missouri, has confirmed that the personal and protected health information of 11,407 individuals has been exposed in an email security incident. On September 16, 2026, a notice was added to the Facial Surgery Group website providing further information on the incident. Suspicious activity was identified within its email system on November 24, 2025. Third-party cybersecurity experts were engaged to investigate the incident and confirmed that a single email account had been accessed by an unauthorized individual.
A data mining company was engaged to review the affected account, and that process was completed on September 9, 2026. The account contained names, birth dates, demographic information, Social Security numbers, financial account numbers, and health information. The affected individuals were notified about the incident on October 9, 2025. Steps have been taken to prevent similar incidents in the future, and the affected individuals have been offered complimentary credit monitoring and identity theft restoration services.
The post University Hospitals Working on Restoring Systems After Cyberattack appeared first on The HIPAA Journal.
$2 Million Settlement Resolves Covenant Health Data Breach Lawsuit – The HIPAA Journal
$2 Million Settlement Resolves Covenant Health Data Breach Lawsuit The HIPAA Journal
$2 Million Settlement Resolves Covenant Health Data Breach Lawsuit
Covenant Health, St. Joseph Healthcare Foundation, St. Joseph Hospital, St. Joseph Hospital Nashua, N.H., and other Covenant Health facilities were named as defendants in multiple class action lawsuits stemming from a 2025 cybersecurity incident. A $2 million settlement has been agreed to resolve the litigation.
Suspicious activity was identified within Covenant Health’s computer systems on May 26, 2025. The forensic investigation determined that its network was first accessed by an unauthorized third party on May 18, 2025. The compromised parts of the network contained the protected health information of 502,606 individuals, including their names, addresses, dates of birth, medical record numbers, Social Security numbers, health information, and health insurance information. Notification letters started to be mailed to the affected individuals on July 11, 2025.
Multiple class action lawsuits were filed in response to the data breach, which were consolidated into a single complaint – In re: Covenant Health Data Security Litigation – in the Penobscot County Superior Court in Maine. The consolidated lawsuit alleged that the defendants were at fault and that the incident and data breach should have been prevented. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, and declaratory judgment. The defendants maintain that there was no wrongdoing and disagree with the claims and contentions in the lawsuit.
The parties attended mediation on April 23, 2026, and agreed to most of the material terms of a settlement. During ongoing negotiations, a settlement was negotiated that was acceptable to all parties. The settlement has now received preliminary approval from the court. Under the terms of the settlement, the defendants have agreed to establish a $2,000,000 settlement fund, which will be used to pay for class member benefits after attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives have been deducted.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Class members may submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member. Class members may also claim a pro rata cash payment, estimated to be approximately $75 per class member. In addition to the cash payments, class members are entitled to claim a two-year membership of the CyEx Medical Shield Complete credit monitoring service. The defendants have also agreed to implement security enhancements to reduce the risk of similar incidents in the future. The deadline for objection and opting out is December 15, 2026. The deadline for submitting a claim is December 30, 2026. The final fairness hearing has will be in early 2027; however, a date has yet to be set.
The post $2 Million Settlement Resolves Covenant Health Data Breach Lawsuit appeared first on The HIPAA Journal.
Preparing for the HIPAA Security Rule Update Before it is Final – Robotics & Automation News
Preparing for the HIPAA Security Rule Update Before it is Final Robotics & Automation News