Cybersecurity & Privacy Archives - HIT Leaders and News

Cybersecurity

Voice AI Tests Healthcare’s Privacy Discipline

Voice AI has entered healthcare through one of the industry’s most sensitive workflow gaps: conversations that shape care but often disappear once they end. Staff meetings, case reviews, shift handoffs, care coordination calls, safety huddles, and operational briefings can contain clinically important context that never makes it into the medical record or formal documentation.

Photo 130409802 | Ai © Funtap P | Dreamstime.com

Browser Security Is Becoming Clinical Infrastructure

The browser has become one of healthcare’s most important clinical access points. That shift is easy to underestimate because browsers still look familiar, ordinary, and low risk. In modern care environments, however, the browser is no longer just a window to the internet. It is increasingly the place where clinicians reach EHRs, virtual desktops, cloud applications, payer portals, analytics tools, collaboration platforms, and patient-facing systems.

Photo 267733173 / Cybersecurity © Yuri Arcurs | Dreamstime.com

Regional Providers Are Carrying National Cyber Risk

The latest cluster of healthcare data breach disclosures is not remarkable because the affected organizations are household names. It is notable because they are not.

ID 48771792 © Elwynn | Dreamstime.com

CareCloud Breach Shows EHR Risk Is Now a Governance Test

The cybersecurity incident disclosed by CareCloud should not be read only as another breach involving a health technology vendor. Its larger significance is more operational. A single electronic health record environment was reportedly affected for roughly eight hours, while other environments and systems were described as unaffected.

Brief Breaches Still Create Long Exposure

The reported cyber incident involving CareCloud should not be measured only by the roughly eight hours during which one electronic health record environment experienced partial disruption. In healthcare, the duration of unauthorized access is only one part of the risk profile.

Oncology Breaches Turn Privacy Into Clinical Risk

The proposed $1.075 million settlement involving South Texas Oncology and Hematology is not just another data breach resolution. It is a signal that specialty healthcare providers can no longer treat cybersecurity as an IT problem that becomes visible only after a forensic investigation.

Cybersecurity: The Vendor Risk Reckoning

The breach at TriZetto Provider Solutions, a Cognizant business, should not be treated as another familiar HIPAA headline. A filing with the Maine Attorney General’s office indicates that 3,429,351 people were affected, while industry reporting tied to the same disclosure said the unauthorized access began on November 19, 2024, and the compromised data was not fully understood until late November 2025. In any sector, that kind of dwell time would be serious

Breach Remediation Is Not Security

A $2.8 million class action settlement can look like accountability. In practice, it often functions more like a pricing mechanism which is an attempt to put a predictable dollar value on a breach that delivered unpredictable harm. The proposed settlement tied to a July 2024 incident involving Gryphon Healthcare follows a now-familiar pattern: modest cash payments for many claimants, higher reimbursement for documented losses, and a bundle of identity and medical monitoring services offered as a standardized remedy, as laid out in the case administrator’s settlement FAQ.

When Provider Numbers Become Passwords

A one-year-and-a-day federal sentence rarely changes the trajectory of Medicaid fraud on its own. The bigger signal comes from the mechanics of the scheme. In a February 10, 2026 announcement from the U.S. Attorney’s Office for the District of Connecticut, a licensed substance use counselor admitted to billing the Medicaid program for psychotherapy sessions that were not provided, then attempted to withstand scrutiny by producing false clinical documentation during an audit. The facts are local. The vulnerabilities are national.

Third-Party Risk Without Third Chances

The $2.87 million settlement between Houston-based revenue cycle vendor Gryphon Healthcare and nearly 400,000 patients affected by a 2024 data breach sends a clear and urgent message to healthcare executives: liability is no longer confined within organizational walls. The breach, which stemmed from unauthorized access via an external IT service provider, underscores a hardening regulatory, legal, and operational reality as healthcare organizations are increasingly held accountable not only for their own security practices, but also for the security posture of their partners.

What Every Healthcare Organization Should Know About FIPS Validation

Healthcare’s digital transformation has created unprecedented opportunity—and unprecedented risk. The U.S. Government’s Administration for Strategic Preparedness and Response (ASPR) paints a dire picture when it comes to healthcare and public health cybersecurity. It reports that the Healthcare and Public Health (HPH) sector continues to experience increasingly sophisticated cyberattacks that exploit complex, interconnected IT systems at hospitals and healthcare facilities.

Cyber Settlements Are Not Security Strategies

Veradigm’s recent agreement to pay $10.5 million to settle litigation over its 2024 data breach may resolve legal exposure—but it does not resolve the deeper credibility crisis now facing health IT vendors. As more than two million patients contend with the long-term fallout of exposed medical and financial information, the episode underscores a persistent structural risk: the widening gap between contractual data responsibility and cybersecurity execution in third-party health tech infrastructure.

Healthcare’s Third-Party Reckoning Begins at the Contract Table

The lawsuit fallout from the TriZetto data breach has accelerated a reckoning long overdue in healthcare IT governance: vendor partnerships are not cybersecurity strategies. As Cognizant Technology Solutions now faces multiple U.S. class-action suits over its handling of a 2020 breach affecting its TriZetto Provider Solutions platform, the liability spotlight is shifting upstream. In a sector increasingly dependent on outsourced infrastructure, cloud-based platforms, and revenue cycle management automation, enterprise buyers can no longer separate procurement from risk management.

$500K Fine for Capital Region Healthcare Center Patient Data Breach

The $500,000 penalty issued to OrthopedicsNY signals a strategic shift in how state regulators are treating healthcare cybersecurity negligence. The case, driven by the New York Attorney General’s investigation, underscores a rising intolerance for technical complacency in an environment where cyberattacks are not just common but systemic.

Three Health Data Breach Settlements Signal New Norm for Post-Breach Accountability

In an unsettling sign of healthcare’s continued vulnerability to cybercrime, three separate class action settlements were reached in December 2025 following major data breaches at Hypertension Nephrology Associates, Asheville Arthritis and Osteoporosis Center, and Intermountain Planned Parenthood. Collectively impacting more than 150,000 patients, these cases reflect not only the growing scope of patient data exposure, but also an emerging legal pattern: negotiated settlements in lieu of drawn-out litigation, with providers neither admitting wrongdoing nor facing regulatory penalties beyond civil resolution.