Judge Approves $3.9M ArCare Data Breach Settlement – The HIPAA Journal
Judge Approves $3.9M ArCare Data Breach Settlement The HIPAA Journal
Judge Certifies Classes in Meta Platforms Healthcare Data Privacy Litigation
A judge has certified classes in consolidated class action litigation against Meta Platforms Inc. over the use of the Meta Pixel tool on healthcare provider and prescription drug provider websites, portals, and applications. Multiple class action lawsuits were filed against Meta Platforms over the use of the Meta Pixel tool on healthcare websites and applications. The lawsuits were consolidated – In Re Meta Pixel Healthcare Litigation – in the United States District Court for the Northern District of California.
The plaintiffs allege that their medical privacy was violated through the improper use of the tracking tool on healthcare websites, which intercepted communications and transmitted sensitive information to Meta Platforms, without patients’ knowledge or consent. The data collected included personally identifiable information and information about patients’ medical conditions, prescriptions, and interactions with their healthcare providers, identifying them as patients. The data collected is monetized by Meta Platforms and used to provide targeted advertising on Meta sites and elsewhere on the web.
The lawsuit alleges that Meta Platforms is aware that its tool is being used on healthcare websites and is collecting sensitive patient data without HIPAA authorizations or consent. The plaintiffs have identified more than 660 hospital systems and medical providers that have added Meta Pixel to their websites and applications. The plaintiffs allege that the addition of the tool on healthcare websites violates Meta Platforms’ contract with its users and federal and state laws.
Meta Platforms disagrees with the claims in the lawsuit and twice sought to have the litigation dismissed. The litigation was allowed to proceed, and on October 30, 2026, U.S. District Court Judge William Orrick of the Northern District of California certified four classes of Facebook users, who allege that their sensitive data was unlawfully collected by Meta Platforms from June 17, 2018, to the present.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The four classes sought certification of claims for breach of contract, breach of implied contract, intrusion upon seclusion, and violation of the California Comprehensive Computer Data Access (CIPA) and Fraud Act (CDAFA). Three of the classes also assert claims for violations of the federal Electronic Communications Privacy Act and the California Invasion of Privacy Act. The CIPA claim was limited to a California subclass.
The four classes certified by the judge are the
- Patient Status Button-Click Class: Includes all Facebook users who had at least one patient portal, medical appointment, bill payment, or diagnostic assessment button click obtained from Meta Platforms from class healthcare providers.
- The Patient Health Information Class: Includes all Facebook users who had at least one communication or fact identifying a doctor, condition, or treatment acquired by Meta Platforms from class healthcare providers, excluding events in the Patient Status Button-Click Class.
- The Prescription Drug Information Class: Includes all Facebook users who had communications with a prescription drug provider website for which they have a prescription obtained by Meta Platforms.
- The Patient Device Intrusion Class: Includes all Facebook users for whom Meta placed an _fbp cookie and/or used computing resources by sending data to Meta through their device and/or by computing Core Setup logic on their device while at a healthcare provider property.
There is no private cause of action in the Health Insurance Portability and Accountability Act (HIPAA), so patients may not take legal action over HIPAA violations. The lawsuit does not assert any claims for violations of the HIPAA Rules; however, the lawsuit does reference HIPAA. The judge determined that HIPAA is relevant to establishing reasonable consumer expectation and possibly a reasonable consumer understanding of the meaning of Meta’s contractual promises regarding partners having lawful rights over the information transferred to Meta via the tool.
Class certification is only one stage in the legal process. The judge has not made any ruling about whether Meta Platforms violated any laws. Meta Platforms has stated that it disagrees with the class certification ruling and plans to appeal. Should that appeal fail, the classes will need to be refined, a formal notice plan agreed, and class members will be given the opportunity to remain or opt out.
Many class action lawsuits have been filed against healthcare providers over their use of Meta Pixel and other website tracking tools. The majority of certified class action lawsuits have resulted in settlements, rather than a trial. Defendants could face a massive jury verdict, while the plaintiffs might lose and face substantial legal costs.
The post Judge Certifies Classes in Meta Platforms Healthcare Data Privacy Litigation appeared first on The HIPAA Journal.
Critical Infrastructure Orgs Warned of Cyberattacks on Refrigeration and Cold Chain Monitoring Systems – The HIPAA Journal
Critical Infrastructure Orgs Warned of Cyberattacks on Refrigeration and Cold Chain Monitoring Systems
A joint cybersecurity warning has been issued by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services, and other government agencies warning of potential cyberattacks targeting the refrigeration and cold chain monitoring systems used in healthcare and public health and other critical infrastructure sectors.
Attacks on European Refrigeration Facilities
The warning was issued days after a series of cyberattacks on the refrigeration systems used by the food supply chain in Europe. An unknown hacker or group started hitting refrigeration systems in mid-October, raising the temperature of cooling units. In one instance, parameters were altered that would have raised temperatures to 302°F (150°C) had the issue not been identified and corrected. Hundreds of supermarkets in France were forced to throw away large amounts of produce due to dangerously high temperatures caused by remote activation of defrosting functions in refrigerators and freezers, and attacks have since spread across Europe.
The French blood bank, EFS, was caught up in the attacks and experienced a near-catastrophic temperature rise due to remotely altered temperature and defrosting thresholds. EFS reported that temperatures were increased to very high levels in certain cold storage rooms used to keep blood products prior to distribution to healthcare and manufacturing facilities. Fortunately, the temperature increase was identified, and action was taken in time to prevent catastrophic loss of blood products.
While the source of the attacks has not been confirmed, analyses have shown that the bulletproof hosting used in the attacks has previously been used by Russia-linked malicious operations, although that alone does not confirm these as state-sponsored hacking attempts. In many cases, temperature control systems were remotely accessed using the manufacturer’s default credentials.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Warning to U.S. Critical Infrastructure Entities
While the current wave of attacks appears to be targeted at Europe, attacks may spread globally. The warning applies to every organization that uses refrigeration and monitoring systems, including healthcare organizations, food and chemical production facilities, and transportation, as they could potentially be targeted. According to the alert, malicious cyber actors are targeting vulnerabilities and weaknesses in unpatched or internet-accessible temperature controllers and commercial refrigeration controllers. Successful attacks could result in food spoilage, loss of inventory, fire hazards, and hardware damage.
Hackers are gaining access to temperature control systems remotely, so the most logical step to take to harden security is to ensure that the control systems cannot be accessed via the internet. In many attacks, default credentials have been used to alter temperature control settings. All default passwords should be changed, and passwords strengthened to protect against brute force attempts to guess passwords. All software should be kept up to date, with patches applied promptly, and if legacy devices are used that are no longer supported by the vendor, they should be retired and replaced.
“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” explained FBI Cyber Branch Operations Director Brett Leatherman. “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk. This fact sheet provides clear, practical steps that network defenders can take to reduce that risk and protect operations. The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI.”
The post Critical Infrastructure Orgs Warned of Cyberattacks on Refrigeration and Cold Chain Monitoring Systems appeared first on The HIPAA Journal.
How Democrats’ Win Could Reshape Healthcare Cyber Policy – BankInfoSecurity
How Democrats' Win Could Reshape Healthcare Cyber Policy BankInfoSecurity
Free Webinar: The Most Overlooked HIPAA Challenges of 2026
Do your employees know the right thing to do in each of these common HIPAA challenges faced by medical practices?
An online review calls for a response.
A patient asks for a copy of their records.
A new vendor needs access to patient information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Overlooked areas can quickly turn into HIPAA problems
In this live webinar Sidney Secchiaroli and Sean Harris will share the common questions they field every day, and the biggest challenges practices either don’t know to explore or completely forget about,
Sidney and Sean have helped hundred’s of medical practices work through day-to-day HIPAA and OSHA compliance questions. They’ll explain what gets missed, where things tend to go wrong and what you can do differently in your practice.
You’ll learn how to:
- Take the right first steps after a suspected HIPAA incident and assess whether it’s a breach.
- Avoid common mistakes when responding to patient requests for copies of their records.
- The do’s and don’ts when dealing with vendors.
- Handle patient testimonials and respond to online reviews (negative and positive) without disclosing Protected Health Information.
Date of Live Webinar: November 18, 2026
Time: 12 PM ET, 11AM CT, 10 AM MT, 09 AM PT
Duration: 01:00 Hour
Can’t join live? Register and we’ll send you the recording.
About The Speakers:
As customer support specialists at Abyde, Sidney Secchiaroli and Sean Harris serve as dedicated HIPAA and OSHA compliance resources for thousands of Abyde’s medical practice customers. Together, they work hands-on with practices nationwide, answering questions, guiding them through their unique situations, and keeping them confident and audit-ready.
Sidney Secchiaroli | Customer Success Specialist, Abyde
Sidney Secchiaroli brings a firsthand understanding of how a busy medical practice operates from her work as a certified medical assistant. At Abyde, she draws on that experience to help practice teams apply HIPAA and OSHA requirements to their daily work. She’ll bring that frontline perspective to the webinar, showing where HIPAA can get overlooked during routine tasks and what teams can do about it.
Sean Harris | Customer Success Specialist, Abyde
Sean Harris has been helping practices with compliance at Abyde since at least 2022. He previously spent several years in construction staffing, where OSHA safety standards were part of daily operations. Today, he helps healthcare teams work through HIPAA and OSHA questions, with a focus on turning requirements into clear steps staff can follow when a problem comes up.
Abyde’s Customer Success team helps thousands of customers across the country put HIPAA requirements into practice.
Date of Live Webinar: November 18, 2026
Time: 12 PM ET, 11AM CT, 10 AM MT, 09 AM PT
Duration: 01:00 Hour
Can’t join live? Register and we’ll send you the recording.
The post Free Webinar: The Most Overlooked HIPAA Challenges of 2026 appeared first on The HIPAA Journal.
Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits – The HIPAA Journal
Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits
Settlements have been agreed to resolve class action data breach lawsuits against Vida Y Salud-Health Systems & Hampton Regional Medical Center.
Vida Y Salud-Health Systems Class Action Data Breach Settlement
Vida Y Salud-Health Systems, a non-profit community-based medical organization and Federally Qualified Health Center in Crystal City, Texas, has agreed to settle class action litigation arising from an October 2025 data security incident that exposed the personal and protected health information of 35,236 individuals. The incident that sparked the lawsuit was first identified on October 7, 2025. The forensic investigation determined that an unauthorized third party accessed its network between October 7 and October 8, 2025, and potentially obtained files containing names, Social Security numbers, credit card/bank account numbers, claims information, and diagnosis/condition information.
Multiple class action lawsuits were filed in response to the data breach. Since the lawsuits made similar claims and had overlapping classes, they were consolidated into a single complaint – Murray et al. v. Vida Y Salud-Health Systems, Inc. – in the 293rd District Court for Zavala County, Texas. The lawsuit names four plaintiffs as class representatives.
The plaintiffs allege that the data breach occurred as a result of a failure of the defendant to implement appropriate cybersecurity measures. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy—intrusion upon seclusion, and breach of fiduciary duty. Vida Y Salud-Health Systems disagrees with those claims and maintains there was no wrongdoing.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
All parties agreed to a settlement to avoid the cost and risks of protracted litigation. Under the terms of the settlement, class members may claim two years of credit monitoring services and a cash payment. Up to $3,500 may be claimed as compensation for documented, unreimbursed losses due to the data breach, up to $3,500 per class member, plus up to four hours of lost time at $20 per hour. If a claim for reimbursement of losses and/or lost time is not submitted, class members may claim an alternative $50 cash payment. Claims are capped at a maximum of $500,000 and will be subject to a pro rata reduction if that total is exceeded. The deadline for objection and opting out is January 4, 2027. The deadline for submitting a claim is January 18, 2027. The final fairness hearing has been scheduled for February 2, 2027.
Hampton Regional Medical Center Class Action Data Breach Settlement
Hampton Regional Medical Center, a nonprofit community hospital in Varnville, South Carolina, has agreed to pay $250,000 to resolve class action litigation stemming from a data security incident last year. Hackers had access to its network from June 18, 2025, to July 16, 2025, and potentially obtained patient data, including names, birth dates, Social Security numbers, driver’s license numbers, demographic information, and medical information. Notification letters started to be mailed to the affected individuals on September 12, 2025. The data breach is still listed on the HHS’ Office for Civil Rights breach portal as affecting 501 individuals.
Two class action lawsuits were filed in response to the data breach, which were consolidated into a single complaint – In re Hampton Regional Medical Center Data Incident Litigation – which is pending in the Court of Common Pleas for the Fourteenth Judicial Circuit, Hampton County, South Carolina. The plaintiffs allege that the defendant was at fault and should have prevented the incident. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, and breach of confidence. The defendant maintains that there was no wrongdoing.
The parties attended mediation and agreed to the terms of a settlement, which has received preliminary approval from the court. Class members may claim reimbursement for documented, unreimbursed losses up to $5,000 per class member or an alternative pro rata cash payment, estimated to be $20 per class member. In addition to one of those cash payments, class members are entitled to one year of single-bureau credit monitoring services. The deadline for objection and opting out is December 24, 2026. The deadline for submitting a claim is January 11, 2027. The final fairness hearing has been scheduled for January 25, 2027.
The post Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits appeared first on The HIPAA Journal.