Preparing for the HIPAA Security Rule Update Before it is Final – Robotics & Automation News
Preparing for the HIPAA Security Rule Update Before it is Final Robotics & Automation News
Athenahealth Says HIPAA Doesn’t Apply to Claude Record Link – FourWeekMBA
Athenahealth’s Claude AI Connection Raises HIPAA Questions – BankInfoSecurity
Athenahealth's Claude AI Connection Raises HIPAA Questions BankInfoSecurity
Athenahealth’s Claude AI Connection Raises HIPAA Questions – GovInfoSecurity
Athenahealth's Claude AI Connection Raises HIPAA Questions GovInfoSecurity
Compliance countdown: What all dental practices should know ahead of the HIPAA Security Rule changes – California Dental Association (CDA)
Compliance countdown: What all dental practices should know ahead of the HIPAA Security Rule changes California Dental Association (CDA)
Hospital Español Auxilio Mutuo de Puerto Rico Settles Data Breach Lawsuit – The HIPAA Journal
Hospital Español Auxilio Mutuo de Puerto Rico Settles Data Breach Lawsuit
A settlement has been agreed to resolve class action litigation against Hospital Español Auxilio Mutuo de Puerto Rico to resolve claims related to a 2023 cybersecurity incident and data breach. The incident that sparked the lawsuit was identified by the U.S. Department of Homeland Security (DHS). DHS notified Hospital Español on September 23, 2023, that a cybercriminal actor had likely breached its network. The investigation confirmed that its network had likely been compromised, although it was not initially clear whether patient data was involved.
A year later, on September 24, 2024, internal and external cybersecurity experts concluded that its network was compromised between August 2022 and September 2023 and that patient data was likely exfiltrated. Data compromised in the incident included names, contact information, health information, health insurance information, billing and claims information, Social Security numbers, and other government-issued ID numbers. Notification letters were mailed to the affected individuals on April 21, 2025, 575 days after the hospital learned from DHS that its network had likely been compromised.
The first class action lawsuit was filed on May 1, 2025. Additional plaintiffs were added to the lawsuit, and an amended complaint was filed – Jose A. Morales Rosario, et al. v. Hospital Español Auxilio Muto De Puerto Rico, Inc. – in the United States District Court for the District of Puerto Rico. The lawsuit alleged that Hospital Español failed to implement appropriate cybersecurity measures, was not effectively monitoring its network for intrusions, failed to adequately train its employees on cybersecurity, and did not issue timely notifications. When the notification letters were issued, the plaintiffs allege that Hospital Español obfuscated the nature of the data breach and the threat it posed.
The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty, and declaratory judgment. Hospital Español sought to have the lawsuit dismissed as it maintains there was no wrongdoing and disagreed with the claims asserted in the lawsuit. All parties discussed the possibility of an early resolution to the litigation to avoid the costs and uncertainties of continued litigation. The terms of the settlement have now been agreed, and the settlement has received preliminary approval from the court. Under the terms of the negotiated settlement, Hospital Español agreed to pay attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A $500,000 settlement fund will be established to provide monetary benefits to the class members. Those benefits are reimbursement of out-of-pocket expenses up to $2,500 per class member or an alternative cash payment, estimated to be $25 per class member. In addition to one of those two benefits, class members may also claim two years of credit and medical monitoring services. Hospital Español has also agreed to implement a range of data security measures to reduce the risk of similar incidents in the future. The deadline for opting out, objecting, and submitting a claim is December 21, 2026. The final fairness hearing has been scheduled for January 20, 2027.
The post Hospital Español Auxilio Mutuo de Puerto Rico Settles Data Breach Lawsuit appeared first on The HIPAA Journal.
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals – The HIPAA Journal
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals The HIPAA Journal
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals
State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal and protected health information of almost 5.7 million individuals. Indianapolis, Indiana-based Marathon Health is an employer-sponsored healthcare provider. The company partners with employers, labor unions, and public sector organizations and provides advanced primary care through onsite and near-site health centers across the United States. According to its website, the company serves more than 600 self-funded employers, labor unions, and public sector organizations, operates more than 720 health centers in 41 U.S. states, has around 1,600 providers, and offers virtual care to individuals in all 50 states. Marathon Health has a patient base of around 3 million individuals.
Only a handful of state attorneys general publish information on the number of state residents affected by data breaches. The Massachusetts Attorney General was informed that 29,075 state residents were affected, and the Vermont Attorney General was notified that 8,858 state residents were impacted. While the website of the Texas Attorney General states that 234,534 Texas residents were affected, law firm Emery Reddy reports that the Texas Attorney General was informed that 5,684,735 individuals are being notified. As a HIPAA-covered entity, the data breach must be reported to the HHS’ Office for Civil Rights (OCR); however, it is not currently listed on the OCR data breach portal. If that total is confirmed, the Marathon Health data breach will rank as the fourth-largest healthcare data breach to be reported by a HIPAA-regulated entity this year.
A copy of the data breach notification letter is available on the website of the California Attorney General. The notice states that on August 24, 2026, suspicious activity was identified related to one of its employee accounts. The affected account was immediately disabled, and an investigation was launched to determine the nature and scope of the activity. Marathon Health learned that an unauthorized individual posed as a Marathon IT worker and tricked the employee into disclosing their credentials. The credentials provided access to a cloud-hosted application, and the unauthorized individual exported information from that application in the space of a few hours on August 24, 2026.
The social engineering tactics – impersonating an IT worker to steal credentials – are used by initial access brokers and several different cybercriminal groups, including the ShinyHunters and Scattered Spider threat groups. Neither group appears to have claimed responsibility for the attack, nor has any ransomware group.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Marathon Health’s review of the impacted data was completed on September 9, 2026. According to the notification letters to California residents, the impacted data included names, contact information, dates of birth, and Social Security numbers. The websites of the Texas and Vermont Attorneys General also state that medical information and health insurance information were compromised. Marathon Health has taken steps to prevent similar incidents in the future and is offering the affected individuals 12 or 24 months of complimentary credit monitoring services. Notification letters started to be mailed to the affected individuals on October 20, 2026.
Due to how Marathon Health operates, some individuals are likely to receive notification letters informing them that some of their data was compromised, when they have not received any healthcare services from the company. They may not be aware of Marathon Health or why the company has their data. The reason is that Marathon Health is provided with information on all enrolled plan members to allow it to verify coverage, communicate benefits, bill insurance companies, and schedule appointments. One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
The post Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals appeared first on The HIPAA Journal.