CHIME; Providers Express Concerns About Proposed HIPAA Privacy Rule Update
A coalition of 17 health systems, hospitals, and clinics led by the College of Healthcare Information Management Executives (CHIME) wrote a letter to HHS Secretary Robert F. Kennedy, Jr., this week, voicing their concern about some of the proposed changes to the HIPAA Privacy Rule to support coordinated care and individual engagement.
The HHS’ Office for Civil Rights (OCR) is due to issue a final rule implementing proposed updates to the HIPAA Privacy Rule. The Notice of Proposed Rulemaking (NPRM) was issued by OCR in the final days of the first Trump Administration; comments were collected by OCR during the Biden administration, then the proposed update stalled. OCR rekindled the proposed update in President Trump’s second term, and the final rule for the HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens was penciled in for an August 2026 release. OCR has not provided any further updates on when it plans to release the final rule, other than previous statements confirming that a final rule is a regulatory priority.
The coalition explains in the letter that efforts to expand patient access to health technology and improve patient engagement could restrict a healthcare provider’s ability to confirm that a third-party application has been authorized by the patient to receive their protected health information. Further, concern was raised about the proposal to remove unreasonable identity verification barriers to individuals exercising their HIPAA Rights, including directing copies of their PHI to third parties. The concerns are legitimate and need to be addressed, as while it is important to improve access to patient data, limiting the ability of providers to verify identity could open the door to bad actors seeking access to patient records.
“A final rule that categorically prohibits providers from confirming whether a patient has authorized a third-party application to receive PHI would represent a material departure from the proposed approach,” stated the coalition in the letter. “Although the NPRM solicited comments on unreasonable verification practices, it did not clearly notify affected parties that OCR might prohibit reasonable confirmation of patient authorization altogether.” Should that be the case, it would be a significant departure from the NPRM.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
“These concerns are further compounded by any presumption that presentation of an IAL2 credential, standing alone, satisfies all verification necessary to effectuate an application-initiated request for PHI. Identity proofing, patient matching, and verification of authority are analytically and operationally distinct functions,” explained the coalition in the letter. “Although an IAL2 credential may provide sufficient assurance as to the identity of the individual, it does not necessarily establish that the individual has been accurately matched to the appropriate medical record, nor does it establish the nature, scope, duration, or validity of the individual’s authorization or direction permitting a third-party application to obtain the requested information. Treating IAL2 credentialing as sufficient for all verification purposes, while restricting providers’ ability to confirm patient authorization, would introduce additional substantive limitations that were not clearly contemplated in the 2021 NPRM.”
The coalition stated that changes to the HIPAA Privacy Rule to improve patient access and support innovation should not come at the expense of providers’ ability to responsibly protect patient information. There is concern that the proposed requirements could increase the risk of privacy breaches and place healthcare providers at risk of regulatory penalties and lawsuits.
The coalition requests that OCR preserve provider discretion to take reasonable, risk-appropriate steps to confirm that a patient has authorized a third-party application to receive their PHI, including confirming that authorization directly with the patient when appropriate. They also request that OCR issue clear guidance and provide examples of what OCR considers to be unreasonable verification barriers as opposed to legitimate provider safeguards.
Should OCR plan to implement a policy that deviates from the original NPRM, the coalition said an additional notice and comment period on the rulemaking would be appropriate. If that is not the case, OCR should ensure that explicit, meaningful enforcement protections are established for providers acting in good faith regarding patient-directed disclosures of their PHI.
The post CHIME; Providers Express Concerns About Proposed HIPAA Privacy Rule Update appeared first on The HIPAA Journal.
Six Healthcare Orgs Settle Pixel Privacy Lawsuits – The HIPAA Journal
Six Healthcare Orgs Settle Pixel Privacy Lawsuits The HIPAA Journal
Six Healthcare Orgs Settle Pixel Privacy Lawsuits
Six healthcare organizations have agreed to settle class action lawsuits stemming from their use of pixels and other tracking technologies on their websites and applications. The lawsuits all allege that the plaintiffs’ sensitive personal and health information was disclosed to third parties via these tools, without their knowledge or consent. In all cases, the healthcare organizations deny any wrongdoing.
Prime Healthcare Pixel Settlement
The Ontario, California-based healthcare provider Prime Healthcare Services, Inc., Centinela Hospital Medical Center, Sherman Oaks Hospital, and Paradise Valley Hospital were sued over their use of third-party tracking technologies, which were added to their websites starting on November 1, 2019. Through these tools, personally identifiable information was transmitted to third parties such as Meta and Google.
The lawsuit – Doe, et al. v. Prime Healthcare Services, Inc., et al. – alleges violations of multiple California laws, including the California Invasion of Privacy Act, the California Confidentiality of Medical Information Act, and the California Customer Records Act, and is pending in the Superior Court of California, Los Angeles County. The class members are individuals who accessed the defendants’ websites between November 1, 2019, and a variety of end dates in 2022 and 2023 depending on the specific provider website that was accessed.
The settlement provides a $20 cash payment to class members and a one-year subscription to the CyEx Privacy Shield Pro digital privacy and fraud protection service. Prime Healthcare has also agreed not to use Google Analytics or Meta Pixel code on its websites for five years and will create a Web Governance Committee, which will conduct annual audits of its websites. If any tracking tools are used, the vendors will be required to sign business associate agreements.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
The negotiated settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for March 9, 2027. The deadline for objection and opting out is December 21, 2026. The deadline for filing a claim is March 9, 2027.
Arcadia Hospital Pixel Settlement
The lawsuit against California’s USC Arcadia Hospital – Merle v. USC Arcadia Hospital – was filed and is pending in the Supreme Court of the State of California, Los Angeles County. The lawsuit alleges that pixels and other tracking tools disclosed sensitive patient data to third parties such as Meta and other tech firms between February 1, 2022, and January 31, 2023.
The settlement provides one of two benefits to class members, who are individuals who completed forms on the website to sign up for email or event updates between February 1, 2022, and January 31, 2023. The benefits are an equal share of a $200,000 settlement fund after attorneys’ fees and expenses, service awards, and administration and notice costs have been deducted, or a 12-month membership to the CyEx Privacy Shield Pro digital privacy and fraud protection service.
The negotiated settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for December 14, 2026. The deadline for objection, opting out, and filing a claim is December 7, 2026.
Tenet Healthcare (Saint Francis Hospital-Memphis) Pixel Settlement
Dallas, Texas-based Tenet Healthcare has agreed to settle a consolidated class action lawsuit over the use of third-party tracking technologies on its websites between January 1, 2017, and September 18, 2023. The lawsuit – Jane Doe v. AMISUB (SFH), Inc. d/b/a Saint Francis Hospital-Memphis – is pending in the Circuit Court for Shelby County, Tennessee.
The settlement provides two benefits to class members, one or both of which may be claimed by individuals who used any website or patient portal owned or operated by Tenet Healthcare, its affiliated covered entities, or former affiliated covered entities to 1) create a patient portal account, 2) complete a web form, or 3) check in to an urgent care or emergency room, or 4) used the Healthelife app, and other web-based tools and services operated by or on behalf of defendant between January 1, 2017, and September 18, 2023.
The benefits for the class members are a one-time cash payment of $16.00 and a two-year membership to the CyEx Privacy Shield Pro digital privacy and fraud protection service. The negotiated settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for January 14, 2027. The deadline for objection and opting out is December 21, 2026. The deadline for filing a claim is March 15, 2027.
Fertility Centers of Illinois Pixel Settlement
Fertility Centers of Illinois, an infertility treatment and reproductive endocrinology practice serving the Chicago metro area, was alleged to have transmitted personally identifiable information to Facebook and Google via website tracking tools between September 1, 2020, and December 31, 2024, in violation of the Electronic Communications Privacy Act.
The lawsuit – L.C. v. Fertility Centers of Illinois, PLLC – is pending in the United States District Court for the Northern District of Illinois. The settlement class consists of individuals who accessed the defendant’s website between September 1, 2020, and December 31, 2024. The settlement provides class members with an equal share of a $375,000 settlement fund, after attorneys’ fees, settlement administration costs, and service awards have been deducted.
The negotiated settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for January 13, 2027. The deadline for objection, opting out, and filing a claim is December 3, 2026.
Dental Intelligence Pixel Settlement
Dental Intelligence, Inc., a Pleasant Grove, Utah-based healthcare technology company that provides software solutions to dental practices, and two of its client dental offices were sued over the addition of tracking tools in its LocalMed patient scheduling software, which is alleged to have transmitted sensitive patient data to Alphabet, Inc. (Google).
The lawsuit – Grivetti et al. v. Dental Intelligence, Inc. – is pending in the United States District Court for the Northern District of Illinois. The settlement agreement covers all individuals who used the LocalMed Portal to schedule, modify, or reschedule an appointment between March 2022 and June 2025, resulting in data being shared with third parties. Claims may be submitted for an equal share of a $5,750,000 settlement fund, after attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives have been deducted.
The negotiated settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for March 25, 2027. The deadline for objection and opting out is December 28, 2026. The deadline for filing a claim is March 25, 2027.
Missouri Delta Medical Center
Missouri Delta Medical Center in Sikeston, Missouri, was sued over its use of third-party website technologies such as Google Analytics and Meta Pixel code, which were alleged to have resulted in disclosures of patients’ sensitive information to third parties. The lawsuit – Jane Doe and Janet Doe v. Missouri Delta Medical Center – is pending in the Circuit for the Court of Scott County, Missouri.
The settlement class consists of all living patients of Missouri Delta Medical Center who logged into the patient portal between October 1, 2017, and December 31, 2022. The settlement provides two benefits to class members. A claim may be submitted for a cash payment of $20.00, and all class members will receive a code to sign up for a one-year membership to the CyEx Privacy Shield Pro digital privacy and fraud-protection service.
The settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for January 4, 2027. The deadline for opting out is November 25, 2026. The deadline for filing a claim and objecting to the settlement is December 28, 2026.
The post Six Healthcare Orgs Settle Pixel Privacy Lawsuits appeared first on The HIPAA Journal.
Top 10 Best HIPAA Compliance Software in 2026 [Ranked & Scored] – CyberSecurityNews
Top 10 Best HIPAA Compliance Software in 2026 [Ranked & Scored] CyberSecurityNews
Health Groups Warn HHS on Potential HIPAA Privacy Changes – BankInfoSecurity
Health Groups Warn HHS on Potential HIPAA Privacy Changes BankInfoSecurity
KMOR – HIPAA- PHS Pet of the Week – Rural Radio Network
KMOR - HIPAA- PHS Pet of the Week Rural Radio Network
Study Provides Insights into Impact of Cyberattacks on Hospital Care – The HIPAA Journal
Study Provides Insights into Impact of Cyberattacks on Hospital Care The HIPAA Journal
Study Provides Insights into Impact of Cyberattacks on Hospital Care
A recent analysis by The Health Management Academy of cyberattacks on U.S. hospitals provides insights into the extent to which patient care is being disrupted by cyberattacks. A growing body of research shows an increase in medical complications and poorer patient outcomes following cyberattacks, and multiple studies suggest increases in mortality rates following a cybersecurity incident such as a ransomware attack. One study suggested an increase in mortality rate of between 34% and 38% for patients admitted to hospital in the week prior to a ransomware attack.
Analysing the impact of cyberattacks on patient care is challenging, however, as The Health Management Academy discovered. Under the HIPAA Breach Notification Rule, data breaches rather than cyberattacks must be reported to the HHS’ Office for Civil Rights. While many cyberattacks involve breaches of patient data, that is not always the case. Cyberattacks can have an impact on patient care when no records are determined to have been breached, and as such, these incidents are absent from the federal record.
Additionally, OCR only publishes summaries of healthcare data breaches that impact 500 or more individuals. A cyberattack may not affect so many individuals in terms of exposed data but may still have an impact on patient care. Further, hospitals and health systems do not always publicly disclose the impact a cyberattack had on patient care.
The Health Management Academy is a member-based organization that connects and supports senior healthcare executives, offering leadership development programs, data and market insights, and creating trusted forums and peer groups where healthcare leaders can discuss shared challenges and share ideas. For its study, cyberattacks on U.S. hospitals and health systems were logged over a 4.5-year period between January 2022 and September 2026, when there was a reported impact on patient care. Data came from news coverage, trade publications, and hospital statements.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
The researchers determined there had been at least 65 cyberattacks on hospitals and health systems during that period that impacted hospital care, including ambulance diversions, cancelled elective surgeries and appointments, and incidents where staff members were forced to switch to paper records. The true figure is likely substantially higher, given that Comparitech tracked 293 ransomware attacks on hospitals, clinics, and other direct care providers in the first 9 months of 2025 alone.
According to The Health Management Academy analysis, the 65 cyberattacks affected at least 305 hospitals in 36 U.S. states, the District of Columbia, Guam, and the US Virgin Islands, with 21 attacks impacting more than one hospital, and one incident impacting 140 hospitals across the United States. In 26 of the logged cyberattacks (40%), ambulances were placed on divert, resulting in patients having to travel to alternate facilities, delaying emergency care. In 28 attacks (43%), patients faced delays in care from cancelled or postponed surgeries, appointments, or treatments.
In 58 attacks (89%), key systems were taken offline, resulting in staff having to work with paper records while the incident was remediated and systems were restored. Out of the 23 attacks where a restoration date was provided for clinical systems such as electronic medical record systems, the median downtime was 15 days, although 51% of attacks saw lengthier downtime periods, with 22% of attacks involving more than a month of downtime.
Based on current figures, in 2025, 807 large healthcare data breaches were reported to OCR and are currently listed on its data breach portal, 81% of which are listed as hacking/IT incidents. The impact of those incidents on patient care is not a reporting metric, and the HIPAA Journal has found through its breach reporting that patient care impacts are often not publicly disclosed.
The Health Management Academy’s incident tracking for its analysis only identified 12 cyberattacks on hospitals and health systems in 2025 where there was a confirmed impact on patient care, and many incidents included in its analysis have still not made it onto the OCR breach portal. One in five cyberattacks that were publicly disclosed more than a year ago is still not listed on the OCR breach portal. While those incidents may not have involved unauthorized access to the protected health information of 500 or more individuals, they caused at least some disruption to patient care.
Given the difficulty in accurately tracking the impact of cyberattacks on patient care, The Health Management Academy suggests tracking and sharing data using metrics such as days of clinical downtime, hours on diversion, and the number of procedures postponed, as it would allow hospitals and health systems to more accurately benchmark their readiness and recovery against peers. Through its programs, there is the option of doing that; however, there are no indications that OCR will mandate any such reporting metrics in the foreseeable future.
The post Study Provides Insights into Impact of Cyberattacks on Hospital Care appeared first on The HIPAA Journal.