The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities and business associates to notify affected individuals when protected health information (PHI) is breached. This rule, established to promote transparency and accountability, now serves as the healthcare sector’s primary line of defense against public fallout after cyber incidents. But that purpose is increasingly out of step with modern threats.

SimonMed Imaging’s disclosure that 1.2 million patients’ records were stolen in a ransomware attack is another chapter in a long, predictable narrative. The breach, reportedly executed by the Medusa ransomware group, included not just personally identifiable information but raw medical imaging files, payment records, and identity documents, data that cannot be replaced, reset, or revoked.

In 2024, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services took more enforcement actions than in any previous year. It also levied its lowest average financial penalties in more than a decade. This divergence reveals a strategic pivot: OCR is broadening its enforcement net, but its ability to impose meaningful consequences remains constrained.

While the Change Healthcare ransomware attack drew national attention in 2024, its implications extend far beyond a single event. It spotlighted a structural vulnerability in the healthcare sector that continues to grow unchecked: the underregulation of business associates.

The 2024 Change Healthcare breach may prove to be a defining event in the history of digital health infrastructure. With over 190 million individuals affected and core operations across thousands of health systems disrupted, the incident was unprecedented in both scale and systemic impact. But it was not an outlier. Ransomware in healthcare is the dominant breach vector.

A recent lawsuit against Verily has reignited concerns about whether health technology firms can consistently meet the operational demands of privacy law. The case, filed by former Verily executive Ryan Sloan, alleges that the company concealed multiple violations of the Health Insurance Portability and Accountability Act (HIPAA), impacting more than 25,000 patients. If substantiated, these claims expose not only lapses in internal governance but also structural weaknesses in how emerging digital health platforms manage regulatory accountability.

Mount Sinai Health System’s recent $5.3 million settlement over the use of web trackers on its patient portal is the latest in a wave of litigation reframing digital analytics as a high-risk privacy exposure, especially for healthcare organizations operating under HIPAA.

The recent disclosure of a data security incident by MDLand International Corporation, a New York-based electronic medical records (EMR) vendor, adds another entry to a growing list of third-party breaches exposing sensitive patient information. While MDLand states that there is no evidence of data misuse and that the event did not involve health systems directly, the incident reflects a broader, structural vulnerability: health data security is only as strong as the least-secure vendor in the healthcare technology chain.