ProxyCare; Oscar Health; AccentCare Announce Data Breaches

Posted by Steve Alder

Data incidents have recently been announced by ProxyCare in Florida, Oscar Health in New York, and AccentCare in Texas.

ProxyCare, Florida

ProxyCare LLC, a Sunrise, Florida-based provider of personalized pharmacy services, has started mailing notification letters to individuals impacted by an August 2025 cybersecurity incident. The company learned on August 22, 2025, that certain computer systems within its network environment had been affected by a cybersecurity incident. Third-party cybersecurity professionals were engaged to determine the nature and scope of the incident, and whether, and to what extent, patient information had been compromised.

The investigation confirmed that patient data had been exposed, and following a comprehensive manual document review, ProxyCare determined on January 29, 2026, that files accessed or acquired by an unauthorized third party in the incident included names, dates of birth, Social Security numbers, and driver’s license numbers. Notification letters were mailed to the affected individuals on March 23, 2026, and individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services.

Based on notifications to state attorneys general, around 150 individuals in Massachusetts and New Hampshire have been affected, but it is currently unclear how many individuals have been affected in total, as the incident has yet to be added to the HHS’ Office for Civil Rights breach portal.

Oscar Health, New York

Oscar Health, Inc., a New York-based health insurance company, has recently disclosed a data privacy incident that resulted in the unauthorized disclosure of a limited amount of member information. On December 31, 2025, Oscar Health learned that member identification cards and other enrollment information related to 2026 health insurance coverage were inadvertently mailed to old and potentially incorrect member addresses.

When the error was identified, immediate action was taken to prevent similar mis-mailing incidents, and an investigation was launched to determine the scope of the event. All individuals potentially affected were identified, and notification letters have now been sent to individuals for whom correct address information could be found, warning them that their name, health insurance policy number, and health insurance plan information were potentially impermissibly disclosed.

Oscar Health confirmed that highly sensitive information such as Social Security numbers, government identification numbers, and financial information was not involved, and there has been no known misuse of the disclosed information. The data breach notice was issued individually and on behalf of its affiliated covered entities, including Oscar Health Plan, Inc., Oscar Insurance Company of Florida, and Oscar Health Plan of Georgia. The incident affected up to 91,350 individuals.

AccentCare, Texas

AccentCare, a Texas-based provider of home health, palliative, and hospice services, has been affected by a data breach at its billing service vendor, Doctor Alliance. The protected health information of 19,772 individuals was potentially compromised in the incident. Doctor Alliance determined on November 16, 2025, that an unauthorized third party had accessed a web application. The forensic investigation determined that the threat actor had access to the application between October 31, 2025, and November 16, 2025, and accessed or exfiltrated files containing patient information.

Data compromised in the incident included names, Social Security numbers, medical record numbers, Medicare numbers, diagnosis/treatment information, provider information, and medical/health information. AccentCare said there was no unauthorized access to its own systems, and no impact to the care provided to its patients. AccentCare is monitoring Doctor Alliance’s response to the incident and its continued role as a service provider.

The post ProxyCare; Oscar Health; AccentCare Announce Data Breaches appeared first on The HIPAA Journal.

Maine House Unanimously Passes Bill to Strengthen Cybersecurity at Maine Hospitals

Posted by Steve Alder

The Maine House of Representatives has voted unanimously to advance a bill that seeks to strengthen cybersecurity at Maine hospitals to prevent cyberattacks and ensure continuity of care following cyber intrusions. The bill faces further votes in the House and Senate in the coming days.

The bill was proposed by Rep. Julie McCabe (D-Lewiston), a member of the Health and Human Services Committee, following two cyberattacks last year that impacted five Maine hospitals –  Covenant Health’s St. Mary’s Hospital in Lewiston, St. Joseph’s Hospital in Bangor, and Central Maine Medical Center’s hospitals in Lewiston, Bridgton, and Rumford. The Covenant Health ransomware attack alone affected 478,188 individuals, and along with the cyberattack on Central Maine Medical Center, around one-third of state residents were affected.

Those cyberattacks had a negative impact on patient care, crippling basic communication services, exposing serious breakdowns in hospitals’ protocols, and causing major disruption to patient care that lasted for weeks, including disruptions to preventative care and cancer care. “Cyberattacks pose a serious risk to our already-fragile health care system,” said McCabe. “We’ve already seen how a cyberattack can impact Maine hospitals and leave patients in dire straits. This legislation will help ensure that our hospitals are prepared to deal with these types of incidents, respond promptly and effectively to patient needs, and protect sensitive information.”

The bill – LD 2103 – requires hospitals to adopt measures to prevent and respond to cybersecurity incidents, and also includes provisions requiring workplace safety measures to protect patients, visitors, and employees from aggressive and violent behavior. According to the Occupational Safety and Health Administration (OSHA), healthcare workers are 4-5 times as likely to suffer injuries due to violence as employees in all other sectors. The bill requires hospitals to have a process in place to receive and record incidents and threats of violence and prohibits representatives or employees of a hospital from interfering with a person making a report.

All hospitals will be required to have a cybersecurity plan consistent with cybersecurity best practices established by the U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Department of Commerce, National Institute of Standards and Technology (NIST), and the Healthcare and Public Health Sector Coordinating Council (HSCC).

The cybersecurity plan must be consistent with HIPAA and be reviewed at least annually. At a minimum, the plan must include provisions to ensure timely notifications to law enforcement, state regulators, patients, and employees about cybersecurity intrusions. All hospitals must have a backup communication response provision to ensure continuity of care for patients in the event of a disruption of hospital computer systems due to a cybersecurity intrusion. That includes a compliant process for patients who experience challenges accessing medical care, a system to triage patients within 48 hours of submitting a complaint about emergent symptoms, and timely management of complaints related to prescriptions.

There is a provision to ensure the triage of all hospital services in the event of disruption to computer systems, including procedures for diverting hospital services, and written agreements with other hospitals to facilitate the continuity of care for patients during any disruption due to a cybersecurity incident. Hospitals must have a written security incident response plan documenting how hospital employees are to report suspected or known security incidents, including how the hospital will respond clinically, and provisions for internal and external communications. Hospitals must also have a system for ensuring that all manually charted medical information is incorporated into electronic medical records in a timely manner.

Cybersecurity training for hospital employees and board members is required at least annually, and incident response and downtime procedures must be reviewed, tested, and updated, as necessary, at least once a year. Further, following any cybersecurity incident, hospitals are required to review the response and take steps to improve procedures for responding to future cybersecurity incidents.

The post Maine House Unanimously Passes Bill to Strengthen Cybersecurity at Maine Hospitals appeared first on The HIPAA Journal.

Trump Administration Proposes 12.5% Cut to HHS Budget for FY 2027

Posted by Steve Alder

The HHS’ Office for Civil Rights (OCR) has long been seeking an increase to its budget to support its HIPAA enforcement activities; however, that is looking unlikely as the Trump Administration is seeking to cut funding for the Department of Health and Human Services (HHS) in 2027.

The Trump Administration has proposed $111.1 billion in discretionary funding for fiscal year 2027, a $15.8 billion (12.5%) cut in funding compared to FY 2026. One of the main casualties is the National Institutes of Health (NIH), which faces a $5 billion cut to its budget, plus $5 billion in cuts through consolidations and eliminations of programs across several sub agencies, including the Health Resources and Services Administration (HRSA), Substance Abuse and Mental Health Services Administration (SAMHSA), Centers for Disease Control and Prevention (CDC), and the Office of the Assistant Secretary for Health (OASH).

The Trump Administration is seeking to establish the Administration for a Healthy America (AHA), which, in part, will involve the elimination of programs that the Trump Administration says promote “radicalized DEI ideologies”, including programs that provide funding for youth LGBTQ services. The AHA was proposed last year, although Congress did not include funding to establish the new department in the budget.

While OCR does not appear to be facing any budget cuts, any increase to its budget to support its enforcement of HIPAA and the Part 2 regulations looks increasingly unlikely. OCR is already having to find funds from its existing budget to pay for an expanded workload, as OCR has been given the responsibility of enforcing the Part 2 regulations.

In a press call following the announcement of the Part 2 enforcement program, the OCR Director said the agency has sufficient resources to manage the additional Part 2 enforcement workload in fiscal year 2026, based on the expected volume of complaints and data breaches.

Since OCR started enforcing compliance with the Part 2 regulations in February and updated its data breach portal, there has been a major slowing of the publication of breach summaries on its “HIPAA Wall of Shame,” which had no breach reports added to the “under investigation” section after February 26, 2026, during the whole of March. Whether this is due to a lack of resources or a change in policy is unclear. OCR does appear to be working on closing investigations faster, as data breaches have been added to the archive section at an increased pace.

While the Trump Administration has proposed its budget with extensive funding cuts, it will be down to Congress to pass that budget, and there is likely to be some resistance to the proposed budgetary cuts at HHS, as was the case with the proposed budget for FY 2026. The Trump Administration sought to cut HHS funding last year; however, Congress actually increased the budget for the HHS in 2026.

The post Trump Administration Proposes 12.5% Cut to HHS Budget for FY 2027 appeared first on The HIPAA Journal.