HIPAA Archives - HIT Leaders and News

Healthcare AI Identity Breach Risk Is Outpacing Governance

Jason Free — Tue, 02 Jun 2026 10:12:07 +0000

Healthcare organizations are adopting AI agents at the same time attackers are becoming more effective at exploiting identity systems. That convergence creates a new cybersecurity problem: AI is no longer only a tool used by clinicians, administrators, or security teams. It is becoming an actor inside the identity environment.

The post Healthcare AI Identity Breach Risk Is Outpacing Governance appeared first on HIT Leaders and News.

Voice AI Tests Healthcare’s Privacy Discipline

Jason Free — Tue, 19 May 2026 09:55:37 +0000

Voice AI has entered healthcare through one of the industry’s most sensitive workflow gaps: conversations that shape care but often disappear once they end. Staff meetings, case reviews, shift handoffs, care coordination calls, safety huddles, and operational briefings can contain clinically important context that never makes it into the medical record or formal documentation.

The post Voice AI Tests Healthcare’s Privacy Discipline appeared first on HIT Leaders and News.

Cybersecurity: The Vendor Risk Reckoning

Jason Free — Mon, 23 Mar 2026 11:15:52 +0000

The breach at TriZetto Provider Solutions, a Cognizant business, should not be treated as another familiar HIPAA headline. A filing with the Maine Attorney General’s office indicates that 3,429,351 people were affected, while industry reporting tied to the same disclosure said the unauthorized access began on November 19, 2024, and the compromised data was not fully understood until late November 2025. In any sector, that kind of dwell time would be serious

The post Cybersecurity: The Vendor Risk Reckoning appeared first on HIT Leaders and News.

Healthcare’s Third-Party Reckoning Begins at the Contract Table

Jason Free — Tue, 06 Jan 2026 21:32:14 +0000

The lawsuit fallout from the TriZetto data breach has accelerated a reckoning long overdue in healthcare IT governance: vendor partnerships are not cybersecurity strategies. As Cognizant Technology Solutions now faces multiple U.S. class-action suits over its handling of a 2020 breach affecting its TriZetto Provider Solutions platform, the liability spotlight is shifting upstream. In a sector increasingly dependent on outsourced infrastructure, cloud-based platforms, and revenue cycle management automation, enterprise buyers can no longer separate procurement from risk management.

The post Healthcare’s Third-Party Reckoning Begins at the Contract Table appeared first on HIT Leaders and News.

Breach Notices Expose the Real Cybersecurity Gap

Jason Free — Mon, 15 Dec 2025 18:01:46 +0000

Two recent breach disclosures from Revere Health and Health Management Systems of America underline an uncomfortable reality in healthcare cybersecurity. The industry is not losing data because attackers are uniquely inventive. The industry is losing time, clarity, and control because too many organizations still cannot answer basic operational questions fast enough, which systems touched protected health information, which vendors sat in the path, and which controls were actually enforced.

The post Breach Notices Expose the Real Cybersecurity Gap appeared first on HIT Leaders and News.

Delayed Breach Disclosures Are Quietly Eroding Healthcare’s Cyber Trust

Jason Free — Mon, 08 Dec 2025 12:11:53 +0000

As breach fatigue sets in across the healthcare sector, a quieter and more corrosive threat is emerging, not just the frequency of cyberattacks, but the time it takes for patients and providers to learn about them.

The post Delayed Breach Disclosures Are Quietly Eroding Healthcare’s Cyber Trust appeared first on HIT Leaders and News.

Breach Notification Rules Were Designed for Disclosure Not Protection

Jason Free — Wed, 29 Oct 2025 10:53:27 +0000

The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities and business associates to notify affected individuals when protected health information (PHI) is breached. This rule, established to promote transparency and accountability, now serves as the healthcare sector’s primary line of defense against public fallout after cyber incidents. But that purpose is increasingly out of step with modern threats.

The post Breach Notification Rules Were Designed for Disclosure Not Protection appeared first on HIT Leaders and News.

HIPAA Enforcement Is Rising But Who’s Really Paying the Price

Jason Free — Mon, 27 Oct 2025 10:46:54 +0000

In 2024, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services took more enforcement actions than in any previous year. It also levied its lowest average financial penalties in more than a decade. This divergence reveals a strategic pivot: OCR is broadening its enforcement net, but its ability to impose meaningful consequences remains constrained.

The post HIPAA Enforcement Is Rising But Who’s Really Paying the Price appeared first on HIT Leaders and News.

Why the Most Dangerous Data Breaches Are Still the Least Regulated

Jason Free — Tue, 21 Oct 2025 11:40:19 +0000

While the Change Healthcare ransomware attack drew national attention in 2024, its implications extend far beyond a single event. It spotlighted a structural vulnerability in the healthcare sector that continues to grow unchecked: the underregulation of business associates.

The post Why the Most Dangerous Data Breaches Are Still the Least Regulated appeared first on HIT Leaders and News.

Marketing Violations Are Becoming a HIPAA Liability

Jason Free — Mon, 06 Oct 2025 12:15:45 +0000

The recent settlement between the Office for Civil Rights (OCR) and Cadia Healthcare is a stark warning that marketing strategies in healthcare are now squarely within the compliance crosshairs. The $182,000 resolution underscores a growing regulatory posture: public-facing patient testimonials, even when seemingly benign, carry legal risk if HIPAA rules are not strictly followed.

The post Marketing Violations Are Becoming a HIPAA Liability appeared first on HIT Leaders and News.