Recent Breaches: Latest Data Breach News & Live Tracker 2026

Workforce attestation is also required by some state laws with more stringent privacy protections than HIPAA. Why is the documentation of every training session – and workforce attestation where required – important? Members of the workforce must be informed about the latest threats, how to recognize them, and how to report them.

Notices must be reviewed and amended as necessary whenever a material https://www.softarmy.com/63949/buy-windows-passseeker-professional-for.html change affects either an individual’s rights or how PHI can be used or disclosed. Why is it important to keep Notices of Privacy Practices compliant with §164.520? For this reason, members of the workforce responsible for obtaining valid authorizations must be trained on the implementation specifications of this standard. Documentation must be stored for at least 6 years, either physically on paper on via HIPAA compliance software. The policies should also include procedures for terminating access to ePHI when a member of the workforce leaves so the departing individual cannot access the organization’s ePHI remotely.

While many types of impermissible uses and disclosures, data thefts, and unauthorized access events are clearly notifiable breaches, there are also many types that are not. Some organizations have delayed notifying individuals about data breaches, increasing the risk of individuals’ data being used to commit identity theft or fraud before individuals have the opportunity to protect themselves from such events. The Administrative Requirements of the Privacy Rule (§164.530) requires covered entities to train all members of their workforces on the policies and procedures developed to comply with the Privacy and Breach Notification Rules. Blue Team Alpha will contact you to arrange a convenient time for your consultation. The figures in this report may increase or decrease as HIPAA-regulated entities complete their breach investigations, and those changes will be reflected in our healthcare data breach statistics page and our annual HIPAA data breach reports.

Salesloft Drift Breach: 700+ Firms Hit in 10 Days

A ransomware group breached its network, stole patient data, encrypted files, and demanded payment to delete the stolen data and unlock the encrypted files. The raw breach data on the OCR breach portal shows data breaches based on the reporting entity, not where the data breach occurred. In July, network servers were the most common location of breached protected health information, followed by email systems. While the same number of healthcare data breaches have been reported as this time last year, hacking/IT incidents have increased by 7.3% year-over-year. As with the incident at Unlimited Technology Systems, no threat group appears to have claimed responsibility.

The second reason – that training must be ongoing – https://indianhelpline.in/business-contact/16097-uttar-pradesh-development-systems-corporation-limited-updesco/index.html is due to the evolving nature of cyberthreats. The first reason – that training is provided to all members of the workforce – is because an attacker can infiltrate a network via a device that does not have access to electronic PHI, and then move laterally through the network until they find a healthcare database to attack. Why must members of the workforce be trained in responding to patient access and accounting requests?

U.S. employee screening service DISA confirms breach affecting over 3 million people

This means the policies have to be sufficiently flexible to support changing roles, promotions, and time off due to (for example) a suspension or maternity leave. As well as eliminating the usefulness of audit logs and access reports, if a system has been configured to reject multiple logins using the same credentials, it could result in users being blocked from accessing ePHI when necessary, or the system being corrupted. The National Provider Identifier identifies your organization or subparts of your organization in Part 162 transactions. The second reason is that organizations who persistently use out-of-date transaction codes can be reported to CMS – which has the authority to enforce Part 162 of HIPAA via corrective action plans and financial penalties. It is important for organizations to monitor changes to transaction code systems for two reasons.

Unlimited Technology Systems, an Ohio-based revenue cycle management and practice management software company, discovered its network had been accessed by an unauthorized third party for five days in October 2025, and potentially obtained the protected health information of more than 3.8 million individuals. The largest data breach occurred at DentaQuest, a Sun Life U.S-owned dental and vision benefits administrator, which fell victim to a cyberattack by the notorious data theft and extortion group ShinyHunters. One of the incidents was the 4th largest https://carsnow.net/ai-invoice-processing-software-for-managing-financial-calculations.html healthcare data breach of all time to be reported by a single HIPAA-regulated entity, affecting an estimated 15 million individuals. Between January and July 2026, the protected health information of 67,400,422 individuals was exposed or impermissibly disclosed; an increase of 35.1% from this time last year.

• Google Threat Intelligence confirmed the scale of exposure, noting hundreds of affected Salesforce instances across multiple sectors.
• Anubis claimed responsibility, but the company’s final public scope remains more reliable than attacker claims.
• Petco disclosed a data exposure on Dec 3, 2025, inferred from a report that cited a Wednesday filing with California’s attorney general, after a software application setting left certain files accessible online.
• The Rainbow Six Siege incident remained a confirmed backend compromise by July 2026, centered on account actions, game credits, cosmetics, and marketplace abuse rather than a confirmed player data theft.
• The scale of the posted data suggests at least partial exfiltration despite bpost’s ongoing investigation.

Regulatory Alignment and Policy Review

The application of sanctions must be documented and records stored for at least 6 years, either physically in paper records or with HIPAA compliance software. The application of sanctions is important to ensure members of the workforce do not take compliance shortcuts “to get the job done”, and the shortcuts deteriorate into a culture of non-compliance. Less common examples include when an individual wishes to revoke an authorization or when HHS’ Office for Civil Rights requests documentation to resolve a HIPAA complaint. There are many examples of when it may be necessary to retrieve documentation within a specific timeframe to comply with HIPAA. Although it is not a requirement of HIPAA to provide an anonymous reporting channel, members of the workforce should be encouraged to speak out when they believe a violation of HIPAA has occurred in order that the incident can be investigated and corrected if necessary.