The Department of Health and Human Services Office of Inspector General (HHS-OIG) has announced that two settlements have been agreed to resolve alleged violations of the Emergency Medical Treatment and Labor Act (EMTALA).

EMTALA was enacted by Congress in 1986 to ensure public access to emergency medical services. EMTALA requires Medicare-participating hospitals that offer emergency services to provide a medical screening examination (MSE) to patients who present to their emergency department requesting an examination or treatment for an emergency medical condition, regardless of the patient’s ability to pay.

A patient must be provided with stabilizing treatment if the MSE determines that they have an emergency medical condition. If the hospital lacks the capability to provide stabilizing treatment, or if requested by the patient, they must initiate an appropriate transfer.  The receiving hospital must have the available space and qualified personnel and must agree to accept the transfer. The transferring hospital must send all medical records related to the emergency condition that are available at the time of the transfer, and send all other records as soon as is practicable. Hospitals that violate EMTALA can face heavy civil monetary penalties, and individuals harmed may pursue legal action for EMTALA violations.

Merit Health Central Hospital

Merit Health Central Hospital in Jackson, Mississippi, formerly known as Central Mississippi Medical Center, has agreed to settle alleged EMTALA violations with HHS-OIG and will pay a $350,000 financial penalty. Unusually, the case relates to patients who presented at the hospital emergency room more than a decade ago. The delay in issuing the penalty was due to a False Claims Act lawsuit related to the alleged EMTALA violations that was working its way through the legal system. HHS-OIG’s investigation determined that the hospital failed to provide an adequate MSE and stabilizing treatment to fourteen patients who presented to its emergency room between January 2013 and April 2015 requesting an examination or treatment for a medical condition.

Out of the fourteen individuals, nine had emergency medical conditions and were transferred to another hospital between January 2013 and May 2013 without providing an appropriate MSE and treatment to stabilize the patients to minimize the risk of transfer, despite having staff within its facilities or available as on-call physicians who could have provided the necessary stabilizing treatment. In six cases, the transfers were based on its application of Central MS Trauma Region Trauma Activation Criteria and Destination Guidelines for the transfer of individuals with penetrating trauma to another hospital. Several of the patients had presented with gunshot wounds.

Four patients presented to the emergency room between March 2015 and April 2015 with a psychiatric emergency medical condition and were not provided with an appropriate MSE within the capabilities of the hospital or stabilizing treatment. The four individuals were transferred by taxi in an unstable condition to a homeless day shelter. One patient presented to the emergency room in March 2015 for treatment related to end-stage renal disease and had an emergency medical condition requiring dialysis, yet stabilizing treatment was not provided even though it was within the hospital’s capabilities.

NorthShore University Health System

NorthShore University Health System in Evanston, Illinois, agreed to settle alleged an EMTALA violation concerning a patient who presented to its emergency room in February 2025 complaining of leg pain and nausea.

The 64-year-old man presented to the emergency department at 10:53 a.m. and was triaged at 11:15 a.m. During triage, the patient’s vitals were taken. He had a heart rate of 126 bpm and was assigned an emergency severity index (ESI) level of 2 – high risk. The patient was placed in a wheelchair in a waiting room but was not reassessed, and his vitals were not rechecked. The patient was found slumped over and unresponsive in the wheelchair at 8:55 p.m – more than 9 hours after he was triaged. The patient was determined to be in cardiac arrest, and CPR was quickly initiated. HHS-OIG’s investigation determined that Northshore failed to provide an appropriate MSE. The case was settled with a $105,000 financial penalty.

The post Merit Health Central Hospital & NorthShore University Health System Settle EMTALA Violations appeared first on The HIPAA Journal.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is shortly due to issue a final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). While the final rule was expected in May 2026, it has been delayed until September 2026. When issued, entities in the 16 critical infrastructure sectors will be required to report substantial cyberattacks to CISA within 72 hours of formulating a reasonable belief that such an incident has occurred.

The Trump administration issued a new cybersecurity strategy in March 2026 that prioritized harmonization and the reduction of compliance burdens, while enhancing cybersecurity of the nation’s critical infrastructure. The nation’s critical infrastructure is dependent on computer-based information systems, most of which are owned by the private sector. Those systems are subject to multiple federal regulations, some of which have overlapping requirements.

The Government Accountability Office was asked to review federal cybersecurity requirements for critical infrastructure to identify potential opportunities for harmonization. A recently published GAO report focuses on the potentially duplicative cybersecurity-related reporting requirements for critical infrastructure sectors. In some cases, the same types of information must be reported to different federal agencies, which requires multiple reports to be written about the same cybersecurity incident or compliance activity. That inevitably means resources are being diverted to compliance activities that could be better used for improving security.

Out of 117 regulations identified by GAO across 9 critical infrastructure sectors, 80 – approximately 70% – had the same kind of reporting requirement as another regulation. Across those 80 regulations, there were at least 125 total reporting requirements, as some regulations required multiple types of reporting – 48 required reporting of cybersecurity incidents, 52 required cybersecurity plans or other technical information, and 25 required reviews, audits, or assessments.

GAO believes that duplicative reporting requirements add an unnecessary administrative burden on critical infrastructure entities, which will soon face the additional reporting requirements of CIRCIA. While CIRCIA will improve federal visibility into cybersecurity incidents, it will certainly add to the reporting burden.

GAO is working on obtaining additional industry perspectives on federal cybersecurity regulations, such as where there are overlapping and duplicative reporting requirements, and it intends to issue an implementation plan to help streamline cybersecurity regulations for critical infrastructure entities.

The post GAO Report Identifies Potentially Duplicative Cyber Reporting Requirements for Critical Infrastructure appeared first on The HIPAA Journal.

The HHS’ Centers for Medicare and Medicaid Services (CMS) and the Centers for Disease Control and Prevention (CDC) have issued a request for information (RFI) on potential updates to the Clinical Laboratory Improvement Amendments (CLIA) of 1988. The RFI covers several topics, including breath testing, laboratory processes and procedures, emergency preparedness, cybersecurity, and the use of artificial intelligence. The feedback received in response to the RFI will advise future actions and rulemaking. Comments are being accepted through September 14, 2026.

The CLIA regulations were enacted on October 31, 1988, strengthening federal oversight of clinical laboratories and helping to ensure the accuracy and reliability of patient test results. The CLIA regulations were promulgated in 1992, and while certain elements of the CLIA regulations have been updated over the years, a substantial update may be required to better reflect current knowledge and advancements in laboratory testing.

One area where updates may be required is cybersecurity, as threats across the healthcare sector have expanded significantly in both scope and severity. “As clinical laboratories increasingly rely on digital systems and connected technologies—such as Laboratory Information System (LIS), Electronic Health Record (EHR) integration, automated diagnostic devices, and virtual or remote access to laboratory and patient data—new cybersecurity risks have emerged,” explained the CMS and CDC in the RFI.

Many U.S. laboratories are HIPAA-regulated entities and must therefore comply with the requirements of the HIPAA Security Rule; however, there are gaps that need to be addressed and threats that the current HIPAA Security Rule does not adequately protect against. The CMS is seeking non-proprietary/non-confidential information on current laboratory cybersecurity practices and experiences related to protecting patient data and lab operations; user identity and access; remote access to systems containing personal information from overseas entities; restrictions on ports and/or internet protocol (IP) addresses; cybersecurity response plans; and cybersecurity training.

One area where further regulation is likely required is artificial intelligence, as the CLIA regulations were enacted long before AI tools started to be used in clinical settings. Model corruption, hallucinations, and compromises could have serious implications for the accuracy and reliability of testing. The CMS and CDC are seeking information on postanalytic interpretation and the use of AI tools, specifically, the algorithms and AI tools used in postanalytic analysis; the circumstances where software and AI tools are being used to interpret test results, histopathology slides, and results; the methods used to verify the performance of those tools; and whether there are any additional technology considerations for high complexity tests that the CMS and CDC should consider incorporating into the CLIA regulations.

The post HHS Seeks Input on Potential Updates to the CLIA Regulations appeared first on The HIPAA Journal.

The U.S. government has announced record-breaking Medicaid fraud charges as part of its 2026 National Health Care Fraud Takedown, with the enforcement action resulting in charges for 455 defendants, including more than 90 doctors and other licensed medical professionals, in connection with more than $6.5 billion in healthcare fraud and opioid abuse claims.

The enforcement action involved a whole-government approach, including U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG), HHS Centers for Medicare and Medicaid Services (CMS), and Drug Enforcement Administration (DEA), with cases in 56 federal districts, 45 U.S. states and territories, and 50 state Medicaid Fraud Control Units participated, more than ever before. There was also unprecedented international cooperation over the two-week takedown. The DOJ seized more than $182 million in cash, luxury vehicles, jewelry, and other assets.

“We are aggressively scaling our offensive against anyone using health care as a front to steal from the American people,” said Assistant Attorney General Colin M. McDonald of the Justice Department’s National Fraud Enforcement Division. “As today’s cases and arrests show, there is no case too big, no scheme too complex, and no hiding place too remote for our relentless fraud-fighting team. Our message is simple: if you put profit over patients, you should expect to be put in prison.”

Advanced Algorithms and AI Tools Used to Shift from Pay-and-Chase to Pre-Payment Detection

The takedown involved the use of cutting-edge data analytics algorithms and artificial intelligence tools to identify potential fraud before criminals cash out, rather than the reactive pay-and-chase approach of previous years. The use of AI tools for fraud prevention is set to expand significantly moving forward. AI tools were used to identify suspicious activity in many of the fraud schemes, including the first-ever criminal prosecution under the Data Fusion Center that was formed last year.

The Data Fusion Center was established to track, identify, and prevent fraudulent billing and medical scams and combines traditional data analytics with financial analysis and comprises experts from the Health Care Fraud Unit’s Data Analytics Team, HHS-OIG, FBI, and other agencies, supported by data sharing agreements between a wide range of government agencies. “Prosecuting criminals who steal from American patients is necessary—but stopping them before a single dollar leaves the building is smarter,” said CMS Administrator Dr. Mehmet Oz.

The Data Fusion Center helped identify a $67 million fraud scheme involving the billing of Illinois Medicaid for behavioral health services that were never provided. The defendant allegedly billed more than 500 hours a day for counselling and therapy services, which could not have been provided even if all providers on staff had been working 24 hours per day. The data analysis showed that patients were hospitalized at other institutions on days when the defendant billed for behavioral health services. Prosecutors opened the case within 5 days of the completion of the data analysis, and the defendant was arrested within 7 months while attempting to flee the country.

Actions by the CMS resulted in the suspension of 1,079 providers and the revocation of billing privileges for 1,403 providers. More than $73 million was obtained in 48 Civil Monetary Payment settlements accompanied by more than 1,400 exclusions, while 25 actions by HHS-OIG are seeking more than $10 billion in payments to the Medicare Trust Fund from payments identified by CMS and blocked before the funds were paid in fraudulent claims. CMS has announced that under a new arrangement, it will provide cloud computing space within its integrated data repository to support the DOJ fraud division’s data analysis algorithms and AI tools to combat health care fraud. Civil charges have been filed against 13 defendants for $14.8 million in health care fraud schemes, along with $23 million in civil settlements with 31 defendants. There have also been 928 administrative cases by the DEA seeking the revocation of authority to handle and prescribe controlled substances since October 1, 2025.

Fraud Costs Taxpayers and Causes Significant Patient Harm

Healthcare fraud costs U.S. taxpayers, exploits vulnerable patients and puts lives at risk, causing considerable patient harm, including death. In one case, the medical director of a cardiovascular testing and treatment practice in Florida was charged in connection with an $89 million fraud scheme to bill for medically unnecessary cardiovascular tests on student athletes. The director falsified diagnoses to defraud health care benefit programs for the testing and is alleged to have rubber-stamped test results as normal without checking them, in some cases stamping test results as normal within seconds.

Student athletes with cardiac abnormalities were not made aware that they were at high risk of sudden cardiac arrest. In one case, a patient’s test results showed an enlarged heart, but the results were signed off as normal. The patient died from complications from his enlarged heart within 24 hours of the test results being signed off as normal.

The DOJ highlighted fraud cases involving wound care, especially allografts, and hospice providers in its announcement, where fraud cases have increased significantly, and these are likely to remain key enforcement areas moving forward. Medicare billing for wound care more than doubled from $3.4 billion in 2023 to $7.5 billion in 2024 and almost doubled again in 2025 to $14.4 billion. The increase in payments was not due to medical necessity; rather, it was driven by illegal kickback and healthcare fraud schemes. Charges were filed in 6 districts for fraudulent claims for amniotic wound allografts against 11 defendants, including a company executive and 8 medical professionals.

In one scheme, a company that did not manufacture allografts obtained them from another firm, added a 2,000% mark-up, paid 40% of that in illegal kickbacks to marketers, and targeted hospice patients, providing medically unnecessary allografts, far exceeding the size of the wound, which were often provided without coordinating with the individual’s treating physician, without proper treatment for infection, and for superficial wounds that did not require the treatment, The defendant was paid more than $24 million by the company, with the marketers and medical professionals involved often paid between $500 and $600 per square centimeter of graft.

“Today’s historic enforcement action sends a clear message: if you use our health care system to enrich yourself at the expense of patients or the American people, we will find you, we will prosecute you, and we will hold you accountable,” said HHS Secretary Robert F. Kennedy, Jr. “HHS will continue working with our law enforcement partners to protect patients, safeguard taxpayer dollars, and restore integrity to our health care system.”

The post DOJ’s Using Advanced Data Analytics and AI Tools to Combat Healthcare Fraud Before Payment appeared first on The HIPAA Journal.

California Attorney General Rob Bonta has filed a lawsuit against the genetic testing company formerly known as 23andMe over its 2023 data breach that affected almost 7 million Americans. The lawsuit alleges multiple violations of state consumer privacy and data protection laws.

23andMe is a provider of direct-to-consumer DNA testing services. Consumers purchase kits for collecting saliva samples, which are sent to the company for DNA analysis. Consumers are given a report detailing their ancestry, ethnicity, and genetic health predispositions, and can access a platform that allows them to trace their biological relatives.

In 2023, 23andMe discovered that around 14,000 accounts had been subject to unauthorized access over a period of around 5 months, resulting in a breach of the personal and genetic information of 6.9 million individuals, including 855,541 California residents. Access to the accounts was gained using a technique known as credential stuffing. Credentials obtained in a data breach on one platform are used to try to access accounts another platform. The technique only works if users reuse their usernames and passwords on multiple platforms. In the case of the 23andMe attack, some of the credentials were stolen from MyHeritage, a separate genealogy site that 23andMe encouraged its users to set up an account with.

The data breach was discovered when the threat actor offered the stolen data for sale on a dark web hacking forum in October 2023. Initially, 23andMe downplayed the incident, maintaining that there had been no breach of its systems, placing the blame on customers for the poor security practice of re-using credentials on multiple platforms. 23andMe also said the breach involved data from its DNA Relatives feature, which was essentially publicly available information. 23andMe paid the threat actor to remove data that had been posted online, stop any sale of stolen data, and to receive information about the vulnerabilities that were exploited by the threat actor to access data.

23andMe, which filed for Chapter 11 bankruptcy protection in March 2025, faced class action litigation over the data breach and agreed to pay $30 million to settle claims related to the data breach, then increased the settlement fund to up to $50 million. The settlement received final approval from a judge in January 2026.

The California Department of Justice, part of a multistate coalition that investigated the data breach, determined that security vulnerabilities were exploited that should not have existed, and that the company’s handing of the breach was “entirely unacceptable.” The investigation determined that there was a well-known risk of unauthorized account access through credential stuffing, yet 23and Me failed to implement reasonable and appropriate security procedures to reduce risk. The data breach was only detected when the threat actor offered stolen data for sale in October 2023. AG Bonta alleged that 23andMe missed several opportunities to detect the credential stuffing attack, such as a suspicious spike in login attempts in July 2023, and a Reddit post discussing a potential 23andMe data breach in August 2023.

A coding error in the DNA Relatives feature meant doctored queries could be sent to the 23andMe database, and when creating and implementing its data security protocols, 23andMe failed to properly account for genetic data and its high level of sensitivity. 23andMe informed its customers that it adhered to the highest industry standards for data security; when its security practices were far below industry standards. Further, when the breach was announced, AG Bonta alleges that 23andMe made misleading statements, repeatedly stating that there had been no breach of 23andMe systems, despite the threat actor informing the company of multiple exploitable vulnerabilities within its systems, some of which were exploited in the attack.

The state Attorney General’s lawsuit was filed in the San Francisco Superior Court, California, and alleges that the company failed to implement and maintain reasonable and appropriate security procedures and practices, made untrue and misleading statements regarding its security measures and practices prior to the data breach, as well as misleading statements about the circumstances of the breach. Those failures are alleged to have violated the California Genetic Information Privacy Act, Reasonable Data Security Law, False Advertising Law, Unfair Competition Law, and the California Consumer Privacy Act. The lawsuit seeks millions of dollars in civil fines to resolve the alleged violations.

The California Attorney General has also challenged 23andMe’s sale of consumers’ genetic information and materials in bankruptcy. That lawsuit is pending in the in U.S. Bankruptcy Court for the Eastern District of Missouri.

The post California AG Files Lawsuit Over 23andMe Data Breach appeared first on The HIPAA Journal.

The Cybersecurity and Infrastructure Security Agency (CISA) has announced a revised schedule of virtual town hall meetings for its Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”) rulemaking.

CISA was affected by the failure of lawmakers to agree on funding for the Department of Homeland Security (DHS), which resulted in a 76-day partial shutdown that ended on April 30, 2026. The shutdown significantly reduced CISA’s operational capacity, with only 38% of its staff remaining on the job over that period. While CISA’s core cyber defense operations were maintained during the partial shutdown, CISA’s outreach activities were a casualty. The CIRCIA virtual town hall meetings initially scheduled for March and April 2026 had to be delayed.

The aim of CIRCIA is to help the government respond quickly to cyber threats and disseminate key information to critical infrastructure sectors in response to those threats. When a final rule is issued, CIRCIA will require critical infrastructure entities to rapidly report significant cybersecurity incidents and ransomware payments to CISA. Covered critical infrastructure entities will be required to notify CISA of any ransom payment within 24 hours and certain cyber incidents within 72 hours.

The rapid reporting required under CIRCIA will allow CISA to quickly deploy resources and provide emergency assistance; build a comprehensive, coordinated, and centralized approach to understanding cyber risks across different critical infrastructure sectors; and identify cyber trends and rapidly share threat intelligence with network defenders and warn potential victims about threats.

Ahead of the publication of a final rule, CISA is seeking stakeholder feedback on the requirements of the CIRCIA Notice of Proposed Rulemaking (NPRM). The aim is to ensure that national cybersecurity is strengthened while minimizing the compliance burden on critical infrastructure entities.

The special topics of interest that were due to be covered in the town hall meetings have not been changed; however, the schedule differs from the original proposal. CISA will be hosting four four-hour virtual town hall meetings, starting on June 15, 2026.

A general session will be hosted on June 15, 2026, followed by a June 16, 2026, virtual meeting for Group A critical infrastructure sectors. These will be followed by a general session on June 17, 2026, and a virtual meeting for Group B critical infrastructure sectors.

• The Group A session is for the communications, dams, emergency services, food and agriculture, government facilities, healthcare and public health, transportation systems, and water and wastewater sectors.
• The Group B session is for the chemical, commercial facilities, critical manufacturing, defense industrial base, energy, financial services, information technology, and nuclear reactors, materials, and waste sectors.

While initially tentatively scheduled for 13:30 a.m. to 3:30 p.m, they have since been moved to 4:30 p.m. to 8:30 p.m. Advance registration is required, and registration will close two business days before the meeting, although early registration is recommended. The sessions will be recorded, and transcripts will be published in the CISA docket for CIRCIA rulemaking.

“CISA is working to maximize the impact of CIRCIA to significantly improve our Nation’s cybersecurity posture. At the same time, CISA values the interest and concern our stakeholders have that CIRCIA will be implemented with minimal unnecessary burden to entities in critical infrastructure sectors,” said Nick Andersen, acting director, CISA. “CISA appreciates our stakeholders’ patience with waiting for our rescheduled town hall meetings to provide their critical input as we finalize this rule. As an agency built on collaboration and coordination, CISA is committed to hearing from the American people, critical infrastructure owners and operators, and other community members.”

The post CISA Announces Rescheduled CIRCIA Virtual Town Hall Meetings appeared first on The HIPAA Journal.

Delta Dental Insurance and Delta Dental of New York (Delta Dental) have agreed to pay a fine of $2.25 million to the New York Department of Financial Services to settle alleged violations of New York cybersecurity regulations. The violations were discovered during an investigation of a 2023 hacking incident that affected almost 7.1 million of its customers.

The incident in question occurred over the Memorial Day weekend in 2023 and was detected by Delta Dental on June 1, 2023. A Russian-speaking cybercriminal group called Clop (aka Cl0p) exploited a zero-day vulnerability in Progress Software’s MOVEit Transfer managed file transfer solution, accessed the solution between May 27 and May 30, 2023, and exfiltrated approximately 60,000 files. The group then demanded a ransom to prevent the publication of the stolen files.

By July 6, 2023, Delta Dental confirmed that a range of sensitive personal and protected health information had been stolen, including names, addresses, Social Security numbers, driver’s license numbers, financial account information, and health information. Delta Dental was one of around 2,700 companies to fall victim to the automated mass exploitation attacks.

Delta Dental Insurance, a dental insurance underwriter, and its subsidiary, Delta Dental of New York, were investigated by the New York Department of Financial Services after being notified about the data breach on December 15, 2023. The Department of Financial Services identified several violations of state laws, including the failure to provide timely notice about the data breach. Under N.Y. Comp. Codes R. & Regs. Tit. 23 § 500.17(a)(1), covered entities are required to notify the superintendent about a cybersecurity incident within 72 hours of discovery.

According to the consent order, Delta Dental did not implement and maintain a written policy addressing incident response, in breach of the New York Cybersecurity regulations for financial services companies – 23 NYCRR § 500.3(n), and did not have a written incident response plan that sufficiently addressed its reporting obligations to regulators, in violation of 500.16(b)(6). Further, Delta Dental did not implement policies and procedures for the secure disposal of data no longer required for business purposes, as required by § 500.13.

The investigation found that most of the data stolen in the attack had been on the server for more than 30 days. By default, MOVEit Transfer sets the data retention period as 30 days; however, Delta Dental had changed the retention period first to 45 days, and then to 60 days for many folders. Some folders had data retention settings disabled and there were no written policies regarding requesting, reviewing, or approving changes to the data retention settings.

Delta Dental is required to pay the financial penalty, although there are no corrective actions required by the order. Provided Delta Dental complies with the consent order, the New York Department of Financial Services will take no further action. “The Department’s nation-leading cybersecurity regulation requires financial institutions to have robust policies in place to protect the personal information of New Yorkers,” said Kaitlin Asrow, acting superintendent of the New York Department of Financial Services. “As cybersecurity threats continue to grow, the Department is committed to holding institutions accountable.”

The post Delta Dental Fined $2.25 Million Over 2023 MOVEit Transfer Hack appeared first on The HIPAA Journal.