Cybersecurity & Privacy Archives - HIT Leaders and News

Cybersecurity

NYC Health Hospitals Data Breach Raises Public Healthcare Cybersecurity Stakes

The reported cybersecurity breach affecting more than 1.8 million people connected to NYC Health + Hospitals is a warning about the scale of cyber risk now sitting inside public healthcare infrastructure.

Illustration 59549239 © Emotionart | Dreamstime.com

Healthcare AI Identity Breach Risk Is Outpacing Governance

Healthcare organizations are adopting AI agents at the same time attackers are becoming more effective at exploiting identity systems. That convergence creates a new cybersecurity problem: AI is no longer only a tool used by clinicians, administrators, or security teams. It is becoming an actor inside the identity environment.

Photo 103483001 / Cybersecurity © Leowolfert | Dreamstime.com

Hartford HealthCare HUSKY Data Breach Exposes Medicaid Portal Risk

The reported exposure of information tied to roughly 22,500 Hartford HealthCare patients through the Connecticut HUSKY provider portal is not simply another healthcare data breach. It is a case study in the cybersecurity risk created when patient information moves through shared infrastructure controlled by multiple organizations.

ID 48771792 © Elwynn | Dreamstime.com

Hartford HealthCare HUSKY Portal Breach Exposes Medicaid Cyber Risk

The reported breach involving Hartford HealthCare patient information accessed through Connecticut’s Medicaid provider portal is a reminder that healthcare data risk increasingly sits in shared systems where providers, state agencies, fiscal agents, and technology vendors intersect.

Voice AI Tests Healthcare’s Privacy Discipline

Voice AI has entered healthcare through one of the industry’s most sensitive workflow gaps: conversations that shape care but often disappear once they end. Staff meetings, case reviews, shift handoffs, care coordination calls, safety huddles, and operational briefings can contain clinically important context that never makes it into the medical record or formal documentation.

Browser Security Is Becoming Clinical Infrastructure

The browser has become one of healthcare’s most important clinical access points. That shift is easy to underestimate because browsers still look familiar, ordinary, and low risk. In modern care environments, however, the browser is no longer just a window to the internet. It is increasingly the place where clinicians reach EHRs, virtual desktops, cloud applications, payer portals, analytics tools, collaboration platforms, and patient-facing systems.

Regional Providers Are Carrying National Cyber Risk

The latest cluster of healthcare data breach disclosures is not remarkable because the affected organizations are household names. It is notable because they are not.

CareCloud Breach Shows EHR Risk Is Now a Governance Test

The cybersecurity incident disclosed by CareCloud should not be read only as another breach involving a health technology vendor. Its larger significance is more operational. A single electronic health record environment was reportedly affected for roughly eight hours, while other environments and systems were described as unaffected.

Brief Breaches Still Create Long Exposure

The reported cyber incident involving CareCloud should not be measured only by the roughly eight hours during which one electronic health record environment experienced partial disruption. In healthcare, the duration of unauthorized access is only one part of the risk profile.

Oncology Breaches Turn Privacy Into Clinical Risk

The proposed $1.075 million settlement involving South Texas Oncology and Hematology is not just another data breach resolution. It is a signal that specialty healthcare providers can no longer treat cybersecurity as an IT problem that becomes visible only after a forensic investigation.

Cybersecurity: The Vendor Risk Reckoning

The breach at TriZetto Provider Solutions, a Cognizant business, should not be treated as another familiar HIPAA headline. A filing with the Maine Attorney General’s office indicates that 3,429,351 people were affected, while industry reporting tied to the same disclosure said the unauthorized access began on November 19, 2024, and the compromised data was not fully understood until late November 2025. In any sector, that kind of dwell time would be serious

Breach Remediation Is Not Security

A $2.8 million class action settlement can look like accountability. In practice, it often functions more like a pricing mechanism which is an attempt to put a predictable dollar value on a breach that delivered unpredictable harm. The proposed settlement tied to a July 2024 incident involving Gryphon Healthcare follows a now-familiar pattern: modest cash payments for many claimants, higher reimbursement for documented losses, and a bundle of identity and medical monitoring services offered as a standardized remedy, as laid out in the case administrator’s settlement FAQ.

When Provider Numbers Become Passwords

A one-year-and-a-day federal sentence rarely changes the trajectory of Medicaid fraud on its own. The bigger signal comes from the mechanics of the scheme. In a February 10, 2026 announcement from the U.S. Attorney’s Office for the District of Connecticut, a licensed substance use counselor admitted to billing the Medicaid program for psychotherapy sessions that were not provided, then attempted to withstand scrutiny by producing false clinical documentation during an audit. The facts are local. The vulnerabilities are national.

Third-Party Risk Without Third Chances

The $2.87 million settlement between Houston-based revenue cycle vendor Gryphon Healthcare and nearly 400,000 patients affected by a 2024 data breach sends a clear and urgent message to healthcare executives: liability is no longer confined within organizational walls. The breach, which stemmed from unauthorized access via an external IT service provider, underscores a hardening regulatory, legal, and operational reality as healthcare organizations are increasingly held accountable not only for their own security practices, but also for the security posture of their partners.

What Every Healthcare Organization Should Know About FIPS Validation

Healthcare’s digital transformation has created unprecedented opportunity—and unprecedented risk. The U.S. Government’s Administration for Strategic Preparedness and Response (ASPR) paints a dire picture when it comes to healthcare and public health cybersecurity. It reports that the Healthcare and Public Health (HPH) sector continues to experience increasingly sophisticated cyberattacks that exploit complex, interconnected IT systems at hospitals and healthcare facilities.