Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits
Settlements have been agreed to resolve class action data breach lawsuits against Vida Y Salud-Health Systems & Hampton Regional Medical Center.
Vida Y Salud-Health Systems Class Action Data Breach Settlement
Vida Y Salud-Health Systems, a non-profit community-based medical organization and Federally Qualified Health Center in Crystal City, Texas, has agreed to settle class action litigation arising from an October 2025 data security incident that exposed the personal and protected health information of 35,236 individuals. The incident that sparked the lawsuit was first identified on October 7, 2025. The forensic investigation determined that an unauthorized third party accessed its network between October 7 and October 8, 2025, and potentially obtained files containing names, Social Security numbers, credit card/bank account numbers, claims information, and diagnosis/condition information.
Multiple class action lawsuits were filed in response to the data breach. Since the lawsuits made similar claims and had overlapping classes, they were consolidated into a single complaint – Murray et al. v. Vida Y Salud-Health Systems, Inc. – in the 293rd District Court for Zavala County, Texas. The lawsuit names four plaintiffs as class representatives.
The plaintiffs allege that the data breach occurred as a result of a failure of the defendant to implement appropriate cybersecurity measures. The consolidated lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy—intrusion upon seclusion, and breach of fiduciary duty. Vida Y Salud-Health Systems disagrees with those claims and maintains there was no wrongdoing.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
All parties agreed to a settlement to avoid the cost and risks of protracted litigation. Under the terms of the settlement, class members may claim two years of credit monitoring services and a cash payment. Up to $3,500 may be claimed as compensation for documented, unreimbursed losses due to the data breach, up to $3,500 per class member, plus up to four hours of lost time at $20 per hour. If a claim for reimbursement of losses and/or lost time is not submitted, class members may claim an alternative $50 cash payment. Claims are capped at a maximum of $500,000 and will be subject to a pro rata reduction if that total is exceeded. The deadline for objection and opting out is January 4, 2027. The deadline for submitting a claim is January 18, 2027. The final fairness hearing has been scheduled for February 2, 2027.
Hampton Regional Medical Center Class Action Data Breach Settlement
Hampton Regional Medical Center, a nonprofit community hospital in Varnville, South Carolina, has agreed to pay $250,000 to resolve class action litigation stemming from a data security incident last year. Hackers had access to its network from June 18, 2025, to July 16, 2025, and potentially obtained patient data, including names, birth dates, Social Security numbers, driver’s license numbers, demographic information, and medical information. Notification letters started to be mailed to the affected individuals on September 12, 2025. The data breach is still listed on the HHS’ Office for Civil Rights breach portal as affecting 501 individuals.
Two class action lawsuits were filed in response to the data breach, which were consolidated into a single complaint – In re Hampton Regional Medical Center Data Incident Litigation – which is pending in the Court of Common Pleas for the Fourteenth Judicial Circuit, Hampton County, South Carolina. The plaintiffs allege that the defendant was at fault and should have prevented the incident. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, and breach of confidence. The defendant maintains that there was no wrongdoing.
The parties attended mediation and agreed to the terms of a settlement, which has received preliminary approval from the court. Class members may claim reimbursement for documented, unreimbursed losses up to $5,000 per class member or an alternative pro rata cash payment, estimated to be $20 per class member. In addition to one of those cash payments, class members are entitled to one year of single-bureau credit monitoring services. The deadline for objection and opting out is December 24, 2026. The deadline for submitting a claim is January 11, 2027. The final fairness hearing has been scheduled for January 25, 2027.
The post Vida Y Salud-Health Systems & Hampton Regional Medical Center Settle Data Breach Lawsuits appeared first on The HIPAA Journal.
As more doctors consult chatbots, health systems can block them — or buy in – STAT
HIPAA Certification for Medical Couriers
HIPAA certification for medical couriers is a training certificate, issued by a private training provider, confirming that a driver has completed instruction on the HIPAA Privacy, HIPAA Security, and HIPAA Breach Notification Rules and passed assessments on how those rules apply to transporting specimens, prescriptions, and medical records. Courier companies, hospitals, laboratories, pharmacies, and insurers ask for this certificate before assigning medical delivery work. No government agency issues it, yet HIPAA itself requires the organizations that employ or contract with couriers to train every workforce member who handles patient information.
What Is HIPAA Certification for Medical Couriers?
HIPAA certification for medical couriers is a record of completed HIPAA training, not a license. The certificate documents that a named courier finished a specific course on a specific date and passed its assessments.
Employers and healthcare clients use the term “HIPAA certified” as shorthand for that training record. A job posting that lists HIPAA certification is asking for proof of training.
Does HIPAA Require Medical Couriers To Be Trained?
HIPAA requires medical couriers to be trained when they are workforce members of a HIPAA-Covered Entity or a HIPAA Business Associate. The HIPAA Privacy Rule at 45 CFR 164.530(b) requires Covered Entities to train their workforce on policies for protected health information. The Security Rule at 45 CFR 164.308(a)(5) requires Covered Entities and Business Associates to run a security awareness and training program.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A courier company that transports identifiable specimens or records for a healthcare provider is a Business Associate. Its drivers are covered by that training duty. Independent couriers receive the same requirement through the Business Associate Agreements and service contracts they sign with healthcare clients.
What Does HIPAA Certification for Medical Couriers Cover?
HIPAA certification for medical couriers covers what counts as protected health information, where it appears during a delivery, how to keep it secure in transit, and how to respond when something goes wrong. A courier learns that a patient name, date of birth, or medical record number on the outside of a specimen bag is protected information. The same applies to manifests, requisition forms, pharmacy labels, signature screens, and delivery apps.
The certification also covers secure handling. Couriers keep paperwork out of sight in the vehicle, lock the vehicle when unattended, protect phones with passcodes, and release items only to authorized recipients.
What Should a Courier Do When a Delivery Goes Wrong?
A courier should report a misdelivery, a damaged label, lost paperwork, or a missing device to the employer or client contact without delay. Each of these events is a potential breach of protected health information. Prompt reporting allows the organization to recover items, assess the risk to patients, and meet breach notification deadlines.
A mistake becomes more serious when it is not reported. HIPAA certification teaches couriers to recognize these events and escalate them through the designated channel rather than attempting to resolve them alone.
Why Do Job Postings List HIPAA Certification as a Requirement?
Job postings list HIPAA certification as a requirement because courier companies must show their healthcare clients that every driver has been trained before handling patient information. Hospitals and laboratories write training requirements into vendor contracts. Insurers covering courier operations review training records when assessing risk.
Applicants who present a current certificate at interview shorten onboarding. The employer spends less time on basic privacy instruction and can assign the driver to healthcare routes sooner.
Why Does Business Associate Training Reflect Courier Work?
Business Associate training reflects courier work because couriers serve healthcare clients rather than treating patients. A single driver may carry information belonging to several providers, follow different client procedures, and operate under several Business Associate Agreements in one shift. Training aimed at hospital staff does not address that situation.
Courier-specific training explains Business Associate responsibilities, permitted uses and disclosures, safeguards, and breach reporting in the context of pickups, transport, and drop-offs.
How Does a Courier Get HIPAA Certified?
A courier gets HIPAA certified by choosing a reputable training provider, completing a course written for medical courier work, passing the assessment that closes each lesson, and downloading the certificate. The course should cover all three main HIPAA Rules, not only privacy awareness. Assessments should allow retakes so that learners reach a passing score through review rather than guesswork.
The completed certificate goes into the courier’s credential file. Couriers send it with job applications and supply it to each new healthcare client during vendor onboarding.
Why Do Employers Verify Certificate Authenticity?
Employers verify certificate authenticity because some applicants have submitted fake or unearned HIPAA certificates. A certificate that cannot be confirmed offers no evidence that training took place. Courier companies check each certificate before making a job offer.
Reputable providers issue certificates with unique identifiers that employers confirm through an online verification service. Couriers who are unsure whether a provider offers verification contact the provider before purchasing a course.
When Do Medical Couriers Renew HIPAA Certification?
Medical couriers renew HIPAA certification every 12 months to meet the annual cycle that healthcare clients write into their contracts. The HIPAA Privacy Rule sets no fixed retraining interval. Annual refresher training is the established practice in healthcare compliance because it reinforces procedures and introduces new risks.
Couriers who also hold OSHA certificates renew all certificates on the same date. OSHA requires bloodborne pathogens training every year for workers with exposure to blood.
What Does The HIPAA Journal’s Course for Medical Couriers Include?
The HIPAA Journal’s HIPAA Certification for Medical Couriers includes four lessons on the purpose of HIPAA, the consequences of violations, the Privacy, Security, and Breach Notification Rules, and the incident reporting duties of workforce members. A short quiz follows each lesson. Learners retake quizzes until they reach a passing score, and there is no final exam.
The HIPAA Journal has reported on HIPAA violations, healthcare data breaches, enforcement actions, and regulatory developments for more than a decade. The course turns the lessons from those reported incidents into practical instruction. Real-world examples show couriers how ordinary decisions on a route lead to complaints, investigations, and penalties.
Learners pass an
The post HIPAA Certification for Medical Couriers appeared first on The HIPAA Journal.
Senate Bill Seeks to Expand Use of AI Technologies in Healthcare and Reimburse for Adoption – The HIPAA Journal
Senate Bill Seeks to Expand Use of AI Technologies in Healthcare and Reimburse for Adoption
A legislative discussion draft has been introduced in the Senate that seeks input from industry stakeholders, clinicians, and policy experts on expanding the use of AI tools in healthcare, while ensuring transparency, patient safety, and compliance with data privacy and security laws. The bill seeks to develop a more predictable and consistent framework for review of AI technologies and establish a reimbursement pathway for adoption of AI-based tools in healthcare.
The bill, the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care (PATIENT AI) Act, was introduced by Senate HELP Committee chair, Senator Dr. Bill Cassidy (R-LA). The bill calls for the U.S. Department of Health and Human Services to engage a nonprofit organization to examine and develop recommendations concerning liability related to AI-based applications in healthcare settings and identify any potential issues. The Comptroller General should produce a report examining public proposals for establishing transparency and explainability measures for the development, validation, use, and deployment of healthcare AI applications
The bill requires the HHS to expand the use of AI within the department to improve the efficiency of internal operations as well as healthcare outcomes, and should work with the Director of the National Institute of Standards and Technology (NIST) and healthcare and public health sector stakeholders to develop materials for training healthcare and public health sector entities on the best uses of AI-based applications in healthcare. The HHS Chief Information Officer (CIO) is instructed to build datasets to be used to support health care research using artificial intelligence-based applications.
Responsibilities have been proposed for the Food and Drug Administration concerning reviews of integrated devices, software-based devices, third-party reviews and certification, postmarket surveillance, applying medical device product liability laws to integrated and software-based devices, and it is required to develop a rolling process for AI software reviews.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The Office of the National Coordinator for Health Information Technology (ONC) should work with agencies within the HHS to provide technical assistance with implementing AI tools within each agency, and expand Certified Health Information Technology to include clinical research technology, and AI-based applications not considered to be FDA-regulated devices. The HHS Secretary is instructed to create a coverage evaluation framework for artificial intelligence-based services, develop payment methodologies to reimburse for AI-based services, and AI-based applications that deliver care autonomously.
“We’re living in a new digital age as artificial intelligence transforms how we deliver care,” said Sen. Cassidy. “Implementing AI in health care must be done responsibly and to the benefit of patients, innovators, and consumers. This discussion draft proposes solutions to expand access to AI-based technologies by creating regulatory predictability while prioritizing patient safety.”
The post Senate Bill Seeks to Expand Use of AI Technologies in Healthcare and Reimburse for Adoption appeared first on The HIPAA Journal.
Data Breaches Announced by HCA Healthcare; Blossom Health
Data breaches have been announced by HCA Healthcare, Blossom Health, El Camino Health, and University of Mississippi Medical Center.
HCA Healthcare Inc.
Nashville, Tennessee-based HCA Healthcare Inc., the operator of 189 hospitals and approximately 2,600 ambulatory sites of care in 19 U.S. states, has disclosed a cybersecurity incident that was first identified on August 12, 2026. Patient and employee data were compromised in the incident.
Suspicious activity was identified within certain IT systems, and the forensic investigation confirmed unauthorized access to those systems on August 12, 2026. HCA Healthcare confirmed that the threat actor obtained copies of certain HR files containing medical resident personal information. The review of the impacted files confirmed that they contained information related to employment, including name, date of birth, email address, phone number, Social Security number, and immigration information.
Patient data was also compromised related to certain affiliated facilities and physician offices. Patient data exposed in the incident included names, email addresses, phone numbers, dates of birth, Social Security numbers, medical information, and health insurance information. The number of affected patients has yet to be disclosed, although 15,096 Texas residents are known to have been affected. The affected individuals have been offered two years of complimentary credit monitoring services.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Blossom Health
Blossom BH Opco Inc., an online telepsychiatry and virtual mental health provider that does business as Blossom Health, has started notifying certain patients about an August 2026 data security incident involving unauthorized access to its electronic health record (EHR) software. According to its October 29, 2026, notification letters, an unauthorized actor gained access to the EHR software and patient data via a phishing attack on a non-employee contractor.
The incident has been investigated, and Blossom Health confirmed that the exposed information included names, contact information, and health insurance information. Blossom Health said financial information and Social Security numbers were not accessible. In its website regulatory disclosure, Blossom Health confirmed that the threat actor downloaded a limited number of patient medical records and a user spreadsheet containing patient information.
The unauthorized access has been blocked, user passwords have been changed, and additional technical security measures have been deployed to reduce the risk of similar incidents in the future. As a precaution against identity theft and fraud, the affected individuals have been offered complimentary single-bureau credit report, credit score, and credit monitoring services. The Texas Attorney General was informed that 2,103 Texas residents have been affected, although the total number of affected individuals has yet to be disclosed.
El Camino Health
El Camino Health, a non-profit health system serving Santa Clara County and the Bay Area in California, has confirmed that an unauthorized individual gained access to its Microsoft 365 environment. Suspicious activity was identified on September 1, 2026, and the forensic investigation confirmed unauthorized access to four Microsoft 365 accounts, which were intermittently accessed between August 26, 2026, and September 2, 2026. Certain documents within those accounts were copied or downloaded.
The review of the affected files has been completed, and they were found to contain contact information, demographic information, Social Security numbers, driver’s license numbers, dates of birth, medical record numbers, patient account numbers, diagnoses, treatment information, prescription information, provider names, dates of service, and health insurance information. A subset of patients also had financial account and routing numbers compromised in the incident.
El Camino Health has implemented additional protection and monitoring measures to reduce the risk of similar incidents in the future, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The number of affected individuals has not yet been publicly disclosed.
University of Mississippi Medical Center
University of Mississippi Medical Center (UMMC) has started notifying certain patients about unauthorized access to its computer systems. The unauthorized access was identified on February 19, 2026. Third-party cybersecurity experts were engaged to assist with the investigation, and on October 20, 2026, it was confirmed that its network was subject to unauthorized access between February 11, 2026, and February 19, 2026.
UMMC has reviewed the exposed files, but its notice to the California Attorney General does not include details of the types of data involved or the number of affected individuals. There is currently no substitute data breach notice on the UMMC website. This appears to have been a ransomware attack. The Medusa ransomware group claimed responsibility for the attack in March 2026 and demanded payment to prevent the sale or release of the stolen data. The ransom was not paid.
The post Data Breaches Announced by HCA Healthcare; Blossom Health appeared first on The HIPAA Journal.
HIPAA Cloud Backup for DICOM: 13 Steps, 90 Min [2026] – tech-insider.org
HIPAA Cloud Backup for DICOM: 13 Steps, 90 Min [2026] tech-insider.org
University Hospitals Working on Restoring Systems After Cyberattack – The HIPAA Journal
University Hospitals Working on Restoring Systems After Cyberattack The HIPAA Journal