Perry Johnson & Associates, Inc. and four related organizations have consented to a multistate settlement costing about $10 million after an investigation confirmed several HIPAA Security Rule and state law violations. The settlement involves Perry Johnson & Associates, Inc. (PJ&A), Medical Transcription and Coding, Inc., Perry Johnson, Inc., Perry Johnson & Associates Radiology, Inc., and … Read more
No federal or state government issues a license specific to medical couriers, so the requirements consist of a standard driver’s license, a local business license for self-employed couriers, a permit for those who haul regulated medical waste, and the training certificates in HIPAA and OSHA safety that healthcare clients treat as the working credential. Those … Read more
A 2025 data breach involving Oracle Health’s legacy Cerner servers compromised personal and medical data of about 20 million people, including approximately 3 million Texans, based on information reported in October 2026. The Texas Attorney General disclosed information indicating that the breach affected almost 20 million people. The breached data included medical data, addresses, and … Read more
The steps to become a medical courier are to confirm eligibility, choose a working model, prepare an insured vehicle, assemble transport equipment, complete HIPAA and OSHA training, add Texas privacy training where it applies, build a credential file, pass employer or client screening, finish site onboarding, and renew training every year. Training sits at step … Read more
The HIPAA compliance software features that help a solo psychologist or counselor are guidance that removes the need to learn the regulations, an assessment that covers home offices and personal devices, monthly maintenance measured in minutes, records that export on request, and human support for questions the platform cannot answer. Does a Solo Clinician Need … Read more
The U.S. Department of Health and Human Services has released version 3.7 of its Security Risk Assessment Tool to help small and medium-sized HIPAA-regulated entities conduct and document risk analyses involving electronic protected health information (ePHI). September 2026 Release The updated Security Risk Assessment Tool, version 3.7, was released in September 2026. The tool is … Read more
Abyde is the best HIPAA compliance software for independent healthcare practices without a dedicated compliance department, because it gives them everything needed to build and keep a complete HIPAA compliance program tailored to how the practice operates, in about 2 to 3 hours for the year and 5 to 10 minutes a month after that, … Read more
Bloodborne pathogens certification for medical couriers refers to OSHA-based training, sold by The HIPAA Journal as a 12-lesson online course, that teaches drivers how HIV and the hepatitis viruses pass from one person to another through infected fluids and how to prevent, report, and follow up on exposure while transporting specimens. Laboratories, hospitals, and clinics … Read more
HIPAA compliance software turns complex regulations into clear tasks by converting each regulatory standard that applies to the practice into a specific, ordered action written in plain language, so a manager acts on an instruction such as “send this vendor an agreement” rather than interpreting a standard written for every covered entity in the country. … Read more
A short HIPAA compliance software checklist tests whether a product records the organization’s own regulatory decisions, covers paper and physical safeguards as well as electronic systems, supports patient rights requests, trains staff on real-world behaviors, preserves records for the six-year retention period, and starts with onboarding that new compliance officials can follow. Eight questions cover … Read more
The United States Consumer Product Safety Commission (CPSC) is seeking to collect digital patient data from hospitals for the National Electronic Injury Surveillance System (NEISS) Remodel project, prompting concerns about the scope of information requested and its compatibility with HIPAA requirements. What is the NEISS Remodel Project? For more than 5 decades, NEISS has been … Read more
Verizon Business has released its inaugural Breach Impact Study, reporting that the median financial impact of data breaches increased from around $60,000 in 2019 to $110,000 in 2025 based on an analysis of approximately 70,000 U.S. cyber insurance claims. The Breach Impact Study was produced by the same authoring team responsible for the Verizon Data … Read more
Abyde offers the leading HIPAA compliance software for independent healthcare practices, measured by the depth of regulatory expertise built into its platform, its record supporting more than 250 federal and state investigations, the human support its customers praise most in public reviews, and a connected, low-effort program that keeps practices current in minutes a month. … Read more
Documented compliance is better than assumed compliance because HIPAA compliance is judged on evidence, and an assumption leaves no record for an investigator to review, while documentation both proves what the practice has done and reveals gaps that an assumption hides. Why Do Practices Assume They Are Compliant? Practices assume they are compliant for understandable … Read more
Onsite Women’s Health agreed to a $2,525,000 settlement following a data breach involving the email account of an employee that resulted in the exposure of protected health information (PHI) of 357,265 individuals after unauthorized access occurred in October 2024. Data Breach Incident Onsite Mammography, LLC, also known as Onsite Women’s Health, in Westfield, Massachusetts, provides … Read more
HIPAA compliance software works in a mental health practice by translating HIPAA into plain questions about the practice, tailoring policies for psychotherapy notes and telehealth, guiding breach decisions after a misdirected message, logging incidents, showing program status through a health score, and keeping the program current in a few minutes a month so clinicians protect … Read more
Keeping every HIPAA compliance record in one place lets a practice locate any document in minutes, keep related records consistent with one another, preserve earlier versions for as long as HIPAA requires, and give an investigator a complete set without a search across inboxes, drives, and filing cabinets. Where Do Compliance Records End Up Without … Read more
Cloud-based HIPAA compliance software keeps pace with changing federal regulations because the vendor tracks new rules, guidance, and court decisions and then updates the platform’s questions, policy language, and training content for every customer, so the practice does not need to follow regulatory developments on its own. How Often Do HIPAA Requirements Change? HIPAA requirements … Read more
Healthcare organizations are reporting an increase in both the frequency and severity of cyberattacks affecting medical devices, with documented impacts on patient care and operational continuity. Rising Concern Over Medical Device Cybersecurity A survey conducted by RunSafe Security among 551 healthcare professionals in the United States, United Kingdom, and Germany identified sustained concern regarding cybersecurity … Read more
The HIPAA compliance software tools that help dermatology practices are an assessment that inventories every device used for clinical photography, risk scorecards that rank photo and device risks, policies tailored to medical and cosmetic workflows, a business associate portal for teledermatology vendors, and collaborative questions that bring providers into the assessment. Does the Assessment Account … Read more
Iowa Attorney General Brenna Bird has filed a lawsuit against Change Healthcare, UnitedHealth Group, and Optum alleging that the February 2024 ransomware attack exposed the electronic protected health information (ePHI) of 192.7 million Americans, including 2.2 million Iowans, and that the defendants misrepresented their cybersecurity practices and response. Complaint Overview Regarding the February 2024 cybersecurity … Read more
HIPAA compliance software keeps a compliance program current through short guided questions each month that follow up on earlier answers and recheck high-risk items, notifications that flag tasks when they become due, and product updates that reflect changes in federal requirements. What Causes a Program to Fall Out of Date? Ordinary operational change causes a … Read more
A ransomware attack on revenue cycle management vendor Catalyst RCM exposed electronic protected health information (ePHI) associated with Vikor Scientific and affiliated laboratories and was reported to federal regulators as affecting 139,964 individuals. Incident Overview Vikor Scientific, a molecular diagnostics company based in Charleston, South Carolina that has rebranded as Vanta Diagnostics, disclosed a data … Read more
HIPAA compliance software reduces exposure to financial penalties by closing the documentation gaps that most often lead to enforcement, keeping a dated record of diligence that places any violation in a lower culpability tier, and preparing the practice to answer OCR promptly, although no product can promise that a penalty will never apply. What Determines … Read more
Comstar LLC agreed to pay $515,000 to resolve allegations by the Massachusetts and Connecticut Attorneys General that the company failed to safeguard sensitive patient medical information in violation of state and federal law. Massachusetts Attorney General Andrea Joy Campbell and Connecticut Attorney General William Tong announced the settlement with Comstar LLC, an ambulance billing vendor … Read more
HB 300 training is mandatory for medical couriers in Texas because Texas Health and Safety Code § 181.101 legally requires every covered entity to train employees with access to Protected Health Information, and HB 300 defines a covered entity broadly enough to include medical courier services regardless of their status under federal HIPAA. This requirement … Read more
Behavioral health clinic, Denton County MHMR Center, located in Denton, Texas, recently submitted a data breach report to the Department of Health and Human Services’ Office for Civil Rights (OCR) where an unauthorized party accessed the protected health information (PHI) of 108,967 present and past patients. The clinic discovered unusual activity within its computer system … Read more
HIPAA compliance software reduces the mental effort of compliance by deciding which requirements apply, setting the order of tasks, remembering deadlines, and telling the responsible person what to do and when, so managing HIPAA takes far less time and mental effort while still requiring the practice’s involvement. What Makes Compliance Mentally Demanding? Uncertainty makes compliance … Read more
TriZetto Provider Solutions, a firm owned by Cognizant, which offers revenue management services to doctors, hospitals, and health networks, began notifying some healthcare clients regarding a recently uncovered cybersecurity incident. On October 2, 2025, TriZetto identified suspicious activity within a web portal utilized by a number of its healthcare organization customers to access TriZetto systems. … Read more
HIPAA compliance software can eliminate the need for a yearly risk analysis rebuild by keeping the HIPAA Security Risk Assessment current through small monthly updates, so the assessment reflects the practice at every point in the year and never has to be rebuilt from scratch. Why Do Practices Rebuild Their Risk Analysis Each Year? Practices … Read more
First Choice Dental, which manages 12 dental clinics in Madison and Dane counties in Wisconsin, suffered a ransomware attack on October 22, 2023. The dental care provider decided to resolve the litigation due to the data security breach. First Choice Dental publicized a temporary notice about the breach, informing patients concerning the exposure of their … Read more
Cybersecurity company Black Fog has published its Q3 2025 State of Ransomware Report. According to the report, ransomware attacks are higher by 36% than in the same quarter last year. Every month during the quarter, attacks increased in comparison to the corresponding month in 2024. The worst month was July with 50% more attacks. The … Read more
The Assistant Secretary for Technology Policy (ASTP) and the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) have introduced the revised version of the Security Risk Assessment (SRA) Tool. The SRA tool was created to support small to medium-sized healthcare organizations in following the security risk assessment requirements of the HIPAA … Read more
Change Healthcare stated that the number of people impacted by its February 2024 ransomware is a bit more than the 190 million individuals it had earlier estimated. The most recent estimate is currently roughly 192.7 million people. That number may be greater than the real number of impacted people. Though Change Healthcare has tried to … Read more
Henry Ford Health agreed to a settlement to deal with a class action lawsuit associated with the usage of third-party tracking codes on health-related sites. This not-for-profit health system based in Detroit, Michigan, is the second-biggest health system in the state. Allegedly, the company put tracking codes on its website that permitted the collection of … Read more
The University of Rochester has decided to pay $2.85 million to settle all claims associated with using tracking tools on its website and MyChart patient site. Like numerous healthcare organizations, the University of Rochester Medical Center (URMC) installed tracking tools on its website to gather data on the use of its website. Tracking tools, usually … Read more
The LockBit ransomware group became very active, with numerous attacks launched, but it encountered a hacking and data leak incident. An unidentified hacker accessed the control panel employed by the group’s affiliates, left the message “Don’t do crime CRIME is BAD xoxo from Prague,” and included a URL for an SQL database. The database did … Read more
University of Maryland Medical System Corporation and University of Maryland Medical Center (UMMC) are facing a class action lawsuit that was filed by six present and past staff members who stated they were affected by cyber-voyeurism and cyber stalking by an ex-UMMC pharmacist. Six Jane Doe plaintiffs filed the lawsuit individually and on behalf of … Read more
Rite Aid has decided to resolve a class action lawsuit associated with a data breach in June 2024 that affected the personal data including PHI of around 2.2 million individuals. Class members are entitled to claim about $10,000 as a refund for documented expenditures sustained because of the data breach. On June 6, 2024, the … Read more
NorthBay Healthcare Corporation manages two hospitals, namely NorthBay VacaValley Hospital and NorthBay Medical Center, and several primary care areas in California. The healthcare system recently reported a data breach affecting the personal data and protected health information (PHI) of 569,012 individuals. According to the notification submitted to the Maine Attorney General, suspicious activity was discovered … Read more
On January 8, 2025, OCR announced a $337,750 settlement that Florida business associate, USR Holdings, LLC agreed to to resolve alleged multiple HIPAA Security Rule violations. USR Holdings owns and operates primary mental health and substance abuse treatment centers in Florida, Kentucky, and Maryland. As a HIPAA business associate, its Port St. Lucie base offers … Read more
New York healthcare company HealthAlliance encountered a breach of the personal data and protected health information (PHI) of 242,641 New York residents. It was instructed to pay a $550,000 financial penalty and take the appropriate steps to reinforce its data security techniques. The healthcare provider serves patients in Delaware and Ulster counties in New York … Read more
Behavioral healthcare provider Cummins Behavioral Health located in Central and Western Indiana, consented to pay $2.1 million to settle a class action lawsuit filed by people impacted by a data breach in 2023. On March 9, 2023, a threat actor left a ransom note for Cummins Behavioral Health stating that it infiltrated its network and … Read more
Harvard Pilgrim Health Care sent an updated report to the Maine Attorney General regarding the number of affected individuals by its April 2023 ransomware attack. There were 106,601 more individuals affected, bringing the total to 2,967,396. The investigation into the breach is still in progress, and the number of impacted individuals may increase further. The … Read more
Specialty Networks, Inc. based in Chattanooga, TN recently reported a data breach impacting the protected health information (PHI) of 411,037 present and former patients. Specialty Networks provides healthcare facilities with radiology information systems and business management solutions. The company specializes in Picture Archiving and Communication Systems (PACS), a medical imaging technology that facilitates medical image … Read more
Advanced Computer Software Group, an IT and software services company in England, is facing a £6.09 million ($7.74 million) financial penalty because of a ransomware attack in August 2022 that caused problems to healthcare and social care organizations in the United Kingdom. The Information Commissioners Office (ICO), the UK’s data watchdog, looked into the attack … Read more
Rite Aid, the third biggest pharmacy company based in Philadelphia with over 2,000 U.S. stores, reported a cyberattack in June that potentially compromised customer’s protected health information (PHI). The breach investigation and incident response by third-party cybersecurity experts are almost completed. All breached systems were recovered and are 100% operational. The analysis of the compromised … Read more
The Qilin ransomware group responsible for an attack that has upset healthcare services throughout London has added Synnovis, a pathology services provider for NHS hospitals, to its darknet leak site. The ransomware attack at the beginning of June on Synnovis resulted in major interferences to services, particularly blood testing. This latest action of Qilin suggests … Read more
Over 100 provider groups, including the American Health Information Management Association (AHIMA), College of Healthcare Information Management Executives (CHIME), and American Medical Association (AMA), wrote to HHS Secretary Xavier Becerra and OCR Director Melanie Fontes Rainer to clarify the requirements of HIPAA breach reporting about the Change Healthcare ransomware attack and the way those requirements … Read more
Winter Haven Hospital Patients’ Data Impermissibly Disclosed BayCare’s Winter Haven Hospital based in Florida is notifying patients concerning an email incident that impermissibly disclosed patient information. On March 15, 2024, a worker made an error while sending forms to a patient by attaching a cardiac rehabilitation department file by mistake to the email that included … Read more
OrthoConnecticut Data Breach OrthoConnecticut has announced that the protected health information (PHI) of about 118,000 patients was exposed in an attack. OrthoConnecticut is a multi-specialty orthopedic company located in Danbury, CT that has 9 centers in the area. It recently discovered unauthorized access to its system and upon inquiry by the forensic group, the unauthorized … Read more
13,000 Patients Affected by the Wisconsin Dental Surgery Center Email Breach Bay Oral Surgery & Implant Center (Bay Oral), a network of oral & maxillofacial dental surgery centers established in the Green Bay, Niagara and Marinette communities in Wisconsin, recently sent a data breach report to the HHS’ Office for Civil Rights (OCR) indicating that … Read more
Valley Mountain Regional Center Data Breach On April 19, 2024, Valley Mountain Regional Center based in California reported a data security breach discovered on August 1, 2023. Strange activity was observed inside its system and quick steps were undertaken to protect its systems. The forensic investigation affirmed that unauthorized individuals got access to its system … Read more
The Federal Trade Commission (FTC) has issued a $7.1 million penalty to the mental health startup company Cerebral for consumer privacy violations and deceitful trading tactics. The $7.1 million financial fine settles claims that the mental health telehealth firm and its ex-CEO, Kyle Robertson, committed violations of the privacy of consumers by impermissibly sharing their … Read more
About 60,000 People Impacted by the Ezras Choilim Health Center Cyberattack Ezras Choilim Health Center based in Monroe, NY recently submitted a breach report to the HHS’ Office for Civil Rights indicating that 59,861 individuals’ protected health information (PHI) were affected. The strange activity was noticed inside its system on September 18, 2023. The forensic … Read more
Aveanna Healthcare Encounters a Breach of Email Account Home health and hospice care provider, Aveanna Healthcare located in Atlanta, GA, reported a security breach of its email network and a compromise of the information of 65,482 individuals. The healthcare provider discovered suspicious activity in a worker’s email account on September 22, 2023. The email account … Read more
On March 12, officials and leaders from the White House, UnitedHealth Group, Department of Health and Human Services, and other industry groups got together to discuss the impact of a cyberattack on UnitedHealth Group’s Change Healthcare. This cyberattack caused problems for healthcare services for the last three weeks. They also discussed ways to help patients … Read more
The Department of Health and Human Services’ Office for Civil Rights (OCR) has published upgraded guidance for organizations covered by the Health Insurance Portability and Accountability Act (HIPAA) regarding online tracking technologies. The current guidance is meant to give increased understanding for HIPAA-governed entities on using these technologies. OCR has revised its position on the … Read more
New Guidance on Using Zero Trust to Control Lateral Movement The National Security Agency (NSA) has given guidance on using zero trust security to control lateral movement inside a network in case a threat actor breaks into the firm’s defenses. It was noticed numerous times in the previous year that threat actors have obtained first … Read more
177,000 Patients Affected by Northeast Orthopedics and Sports Medicine Breach Northeast Orthopedics and Sports Medicine based in Nanuet, NY recently reported a cyberattack that impacted 177,276 people and compromised the protected health information (PHI) of 177,101 individuals. Abnormal activity was found in its system on November 22, 2023. The investigation by third-party forensics experts confirmed … Read more
Feds Warns Healthcare Sector Regarding ALPHV/Blackcat Ransomware Group A joint cybersecurity notification was released by the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the Federal Bureau of Investigation (FBI) about identified Indicators of Compromise (IoCs) and the newest Tactic, Techniques, and Procedures (TTPs) employed by the ALPHV/Blackcat … Read more
Vulnerabilities discovered in the remote desktop program ConnectWise ScreenConnect are being taken advantage of to have an assortment of various malicious payloads into company environments. ConnectWise first announced the vulnerabilities on February 13, 2024. Then, attacks aimed at the vulnerabilities began one day after the launch of patches. One vulnerability, CVE-2024-1709, is an authentication bypass … Read more
2.35M Individuals Impacted by American Vision Partners Breach Medical Management Resource Group, LLC (MMRG), also known as American Vision Partners, has affirmed in a breach notification letter sent to the HHS’ Office for Civil Rights that the protected health information (PHI) of 2,350,236 persons was exposed in a hacking incident. MMRG discovered unauthorized activity in … Read more
California Attorney General Rob Bonta has declared that a $5 million settlement with Quest Diagnostics has been reached to fix allegations that it is unlawfully dumping hazardous and medical waste materials and disposed of the unredacted personal health information of patients in typical trash dumps. An investigation of the business protocols of Quest Diagnostics was … Read more
Ransomware Attack at Prestige Care Senior care organization Prestige Care, Inc. located in Vancouver, WA recently informed 38,087 individuals about the potential access or theft of some of their personal data and protected health information (PHI) in a ransomware attack that occurred on September 2023. The attack was discovered on September 7, 2023, and the … Read more
Ransom Payments Surpassed $1 Billion in 2023 Chainalysis’ new report showed ransomware attack victims paid $1.1 billion to attackers in 2023 to retrieve the keys to unlock their information and to stop the exposure of stolen data. For the first time in 2023, ransom payments were over $1bn and the yearly total jumped from $567 … Read more
The most recent information from the ransomware remediation company, Coveware, reveals a decline in the number of ransomware attack victims who opt to pay the ransom. At the beginning of 2019, 85% of ransomware attack victims gave ransom payments after an attack. In mid-2021, only 46% percentage paid the ransom. In Q4 of 2023, merely … Read more
Hospital IT Help Desks Attacked in Advanced Payment Fraud Scam American Hospital Association (AHA) reports that cybercriminals are targeting U.S. hospitals in a sophisticated payment fraud scam. The AHA has obtained several reports of scammers calling hospital IT departments to carry out password resets and register new devices to get multifactor authentication (MFA) codes. When … Read more
61,000 ConsensioHealth Patients Affected by Ransomware Attack Medical billing service, ConsensioHealth, based in Wisconsin recently informed 60,871 persons regarding a ransomware attack in July 2023. The attack was detected on July 3, 2023, when employees could not access files on its system. Steps were quickly undertaken to stop the unauthorized access. Third-party cybersecurity professionals helped … Read more
Parathon by JDA eHealth Systems Reports a Cyberattack A revenue cycle management firm, Parathon by JDA eHealth Systems located in Naperville, Illinois, recently sent a notification to the state attorneys general that it encountered a cyberattack last July 27, 2023. In December 22, 2023, it notified the Montana Attorney General that unauthorized persons got access … Read more
Threat Actors Contact Integris Health Patients After Cyberattack Integris Health, the biggest not-for-profit health system owned by Oklahoma, has reported the compromise of its internal systems in a cyberattack. The unauthorized third party acquired patient information during the attack. Integris Health manages 15 hospitals in the state and some specialty clinics, centers of excellence, and … Read more
The following companies have reported data breaches in December 2023: Cardiothoracic and Vascular Surgeons, Erie Family Health Centers, ZOLL Medical Corporation, Health Diagnostic Management, Rush System for Health, and BlueCross BlueShield of Tennesse. Cyberattack on Cardiothoracic and Vascular Surgeons Cardiothoracic and Vascular Surgeons based in Texas learned on October 13, 2023 that an unauthorized individual … Read more
The Pediatric Physicians’ Organization at Children (PPOC) encountered a malware attack on February 10, 2020, causing a system outage. 500+ pediatricians, doctor assistants and nurse practitioners were not able to access patient data and consultation calendar. The PPOC is a physician group affiliated with Boston Children’s Hospital. PPOC has approximately 200 servers. The malware attack … Read more