Health Groups Warn HHS on Potential HIPAA Privacy Changes – BankInfoSecurity
Health Groups Warn HHS on Potential HIPAA Privacy Changes BankInfoSecurity
Study Provides Insights into Impact of Cyberattacks on Hospital Care – The HIPAA Journal
Study Provides Insights into Impact of Cyberattacks on Hospital Care The HIPAA Journal
Study Provides Insights into Impact of Cyberattacks on Hospital Care
A recent analysis by The Health Management Academy of cyberattacks on U.S. hospitals provides insights into the extent to which patient care is being disrupted by cyberattacks. A growing body of research shows an increase in medical complications and poorer patient outcomes following cyberattacks, and multiple studies suggest increases in mortality rates following a cybersecurity incident such as a ransomware attack. One study suggested an increase in mortality rate of between 34% and 38% for patients admitted to hospital in the week prior to a ransomware attack.
Analysing the impact of cyberattacks on patient care is challenging, however, as The Health Management Academy discovered. Under the HIPAA Breach Notification Rule, data breaches rather than cyberattacks must be reported to the HHS’ Office for Civil Rights. While many cyberattacks involve breaches of patient data, that is not always the case. Cyberattacks can have an impact on patient care when no records are determined to have been breached, and as such, these incidents are absent from the federal record.
Additionally, OCR only publishes summaries of healthcare data breaches that impact 500 or more individuals. A cyberattack may not affect so many individuals in terms of exposed data but may still have an impact on patient care. Further, hospitals and health systems do not always publicly disclose the impact a cyberattack had on patient care.
The Health Management Academy is a member-based organization that connects and supports senior healthcare executives, offering leadership development programs, data and market insights, and creating trusted forums and peer groups where healthcare leaders can discuss shared challenges and share ideas. For its study, cyberattacks on U.S. hospitals and health systems were logged over a 4.5-year period between January 2022 and September 2026, when there was a reported impact on patient care. Data came from news coverage, trade publications, and hospital statements.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
The researchers determined there had been at least 65 cyberattacks on hospitals and health systems during that period that impacted hospital care, including ambulance diversions, cancelled elective surgeries and appointments, and incidents where staff members were forced to switch to paper records. The true figure is likely substantially higher, given that Comparitech tracked 293 ransomware attacks on hospitals, clinics, and other direct care providers in the first 9 months of 2025 alone.
According to The Health Management Academy analysis, the 65 cyberattacks affected at least 305 hospitals in 36 U.S. states, the District of Columbia, Guam, and the US Virgin Islands, with 21 attacks impacting more than one hospital, and one incident impacting 140 hospitals across the United States. In 26 of the logged cyberattacks (40%), ambulances were placed on divert, resulting in patients having to travel to alternate facilities, delaying emergency care. In 28 attacks (43%), patients faced delays in care from cancelled or postponed surgeries, appointments, or treatments.
In 58 attacks (89%), key systems were taken offline, resulting in staff having to work with paper records while the incident was remediated and systems were restored. Out of the 23 attacks where a restoration date was provided for clinical systems such as electronic medical record systems, the median downtime was 15 days, although 51% of attacks saw lengthier downtime periods, with 22% of attacks involving more than a month of downtime.
Based on current figures, in 2025, 807 large healthcare data breaches were reported to OCR and are currently listed on its data breach portal, 81% of which are listed as hacking/IT incidents. The impact of those incidents on patient care is not a reporting metric, and the HIPAA Journal has found through its breach reporting that patient care impacts are often not publicly disclosed.
The Health Management Academy’s incident tracking for its analysis only identified 12 cyberattacks on hospitals and health systems in 2025 where there was a confirmed impact on patient care, and many incidents included in its analysis have still not made it onto the OCR breach portal. One in five cyberattacks that were publicly disclosed more than a year ago is still not listed on the OCR breach portal. While those incidents may not have involved unauthorized access to the protected health information of 500 or more individuals, they caused at least some disruption to patient care.
Given the difficulty in accurately tracking the impact of cyberattacks on patient care, The Health Management Academy suggests tracking and sharing data using metrics such as days of clinical downtime, hours on diversion, and the number of procedures postponed, as it would allow hospitals and health systems to more accurately benchmark their readiness and recovery against peers. Through its programs, there is the option of doing that; however, there are no indications that OCR will mandate any such reporting metrics in the foreseeable future.
The post Study Provides Insights into Impact of Cyberattacks on Hospital Care appeared first on The HIPAA Journal.
HIPAA- PHS Pet of the Week – Rural Radio Network
HIPAA- PHS Pet of the Week Rural Radio Network
KNEB-AM 960 AM – 100.3 FM – HIPAA- PHS Pet of the Week – Rural Radio Network
KNEB-AM 960 AM – 100.3 FM - HIPAA- PHS Pet of the Week Rural Radio Network
Why shared EHR logins put physician practices at risk under HIPAA – Medical Economics
Why shared EHR logins put physician practices at risk under HIPAA Medical Economics
Insider Data Theft Incident Reported by Premise Health – The HIPAA Journal
Insider Data Theft Incident Reported by Premise Health The HIPAA Journal
Insider Data Theft Incident Reported by Premise Health
Premise Health Holding Corp has announced that a former employee copied patient data without authorization. Data security incidents have also been announced by Telecare Corporation and Enara Health.
Premise Health Holding Corp.
Premise Health Holding Corp., a Brentwood, Tennessee-based direct healthcare provider that works with employers, unions, and health plans to provide employer-sponsored and workplace healthcare solutions, has identified unauthorized copying of patient data by a former employee.
Premise Health, which has over 800 wellness centers in 46 states and Guam, said the insider theft incident was identified on September 18, 2026. The employee was determined to have violated company policies and misappropriated company data starting on March 26, 2026. The employee’s credentials were immediately revoked to prevent further access, security controls were validated, and an investigation was launched to determine the extent of data theft.
On October 14, 2026, Premise Health obtained the preliminary results of the data analysis. The data has now been validated, and notification letters have been mailed to the affected individuals. The data copied by the employee included names, addresses, dates of birth, government identification numbers such as Social Security numbers, health insurance information, diagnostic/treatment information, and other information provided in relation to eligibility for Premise Health services.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Premise Health has confirmed that the employee has been terminated and law enforcement has been notified. Premise Health did not state why the employee copied the data but said it has not identified any data misuse. Additional security measures have been implemented to prevent similar incidents in the future. The total number of affected individuals has yet to be publicly disclosed, although the incident is known to have affected more than 66,000 individuals in South Carolina and almost 2,000 individuals in Vermont.
Telecare Corporation
Telecare Corporation, an Alameda, California-based mental health and behavioral services provider, has announced a data security incident that was first identified on January 25, 2026. An investigation was launched after suspicious activity was identified. Third-party cybersecurity experts were engaged to assist with the investigation, containment, and remediation processes. Unauthorized network access was confirmed, and the compromised systems were reviewed to determine the individuals affected and data involved.
The data review was completed on September 4, 2026. Telecare said the types of data involved varied from individual to individual, and may have included names, addresses, Social Security numbers, dates of birth, driver’s license numbers, diagnosis/condition information, treatment information, lab test results, medications, medical record/patient ID numbers, and health insurance information.
Telecare said it has reviewed and revised its technical safeguards and is enhancing data security measures to reduce the risk of similar incidents in the future. No misuse of the affected data has been identified; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The number of affected individuals has yet to be publicly disclosed.
Enara Health, Inc.
Enara Health, Inc., a digital health platform provider and virtual care network focused on obesity treatment and weight management, started notifying individuals on November 6, 2026, about a data security incident that was first identified on September 10, 2026.
Suspicious activity was identified within its provider platform. Passwords were changed, the affected accounts were disabled, and an investigation was launched to determine the nature and scope of the activity. The forensic investigation determined that the provider application was accessed by an unauthorized third party on September 10, 2026. Its network and other systems remained secure at all times.
While the application was only accessed for a short time, data within the application was copied. The types of data involved varied from individual to individual and may have included names, email addresses, phone numbers, dates of birth, provider names, and limited self-reported medical information. The number of affected individuals has yet to be publicly disclosed.
The post Insider Data Theft Incident Reported by Premise Health appeared first on The HIPAA Journal.
CISA Seeks More Granular Information on Cyber Incidents – The HIPAA Journal
CISA Seeks More Granular Information on Cyber Incidents The HIPAA Journal