Nearly 20 million individuals. That is the confirmed scope of the 2025 data breach tied to Oracle Health's legacy Cerner servers, placing it among the largest healthcare data breaches in recorded history. If that number doesn't stop a health system board meeting cold, I don't know what will. The Infrastructure Problem No One Wants to Own The Oracle Health breach didn't come from a zero-day exploit or a sophisticated nation-state attack on hardened infrastructure. It came from

The HIPAA Journal's H1 2026 Healthcare Data Breach Report shows a 5.9% decline in breach volume compared to the same period in 2025. I have been through enough of these cycles, at NCQA, in federal health IT programs, and now advising healthcare organizations through SOC 2 and HIPAA compliance examinations, to recognize this moment. It is the moment when leadership gets comfortable. That comfort is the actual risk. The Context Healthcare Leaders Need Breach volume is one dimen

A new analysis confirms what most of us in health IT have known operationally for years: three out of four active ransomware groups are consistently targeting healthcare organizations. Not occasionally. Not opportunistically. Consistently. That number deserves more than a CISO briefing memo. It deserves a board-level response. Why Healthcare Is Structurally Exposed Healthcare became a preferred ransomware target not because of any single vulnerability, but because of a struct

On September 17, 2026, two Democratic Senators reintroduced the Health Infrastructure Security and Accountability Act. Most healthcare executives will file this under "legislation to watch" and move on. That would be a mistake. The Change Healthcare breach proved Congress can no longer look away from healthcare's cybersecurity failures, and this bill reflects that reckoning. Why HIPAA's Flexibility Has Become a Liability The healthcare sector has operated under HIPAA's Securi

There are two ways to respond to the proposed HIPAA Security Rule. The first is to treat it as a cost of doing business, a compliance burden to be met at the lowest defensible price. The second is to treat it as a forcing function that, handled well, produces a genuine competitive advantage. Most healthcare organizations will choose the first path by default. The ones that choose the second will spend the same money and come out meaningfully ahead. I want to explain why. I ha

This series has argued that the proposed HIPAA Security Rule is the most consequential change to healthcare security in twenty years, that it converts compliance into an evidence discipline, that it will be judged by what an auditor can verify, and that it can be turned into competitive advantage. This final article is the one that matters most operationally: what do you actually do, and by when. Start with the timeline, because it is tighter than most executives assume. The

The FDA just issued a discussion paper on regulating Generative AI as a medical device. Most healthcare executives will file it under "watch and wait." That is the wrong read. I have spent my career inside federal health IT, at NCQA, and now advising healthcare organizations through some of the most demanding compliance frameworks in the industry. I know exactly what happens between a federal discussion paper and an enforcement action. The gap is shorter than you think. The R

The Baylor Genetics breach should stop every healthcare CISO and health plan executive in their tracks. Not because 2.8 million patient records is shocking in volume anymore. Because it proves that a category of vendor most healthcare organizations have never properly governed is now producing major breach events, and the regulatory and liability exposure flows straight back to the contracting organization. The Collision Nobody Planned For The clinical genomics market has gro

In the first article in this series, I made the case that the proposed HIPAA Security Rule turns compliance from a documentation exercise into an engineering discipline. This article gets specific. If "addressable" is disappearing, the obvious question every healthcare executive should be asking is: mandatory to do what, exactly? The Notice of Proposed Rulemaking that the HHS Office for Civil Rights published on January 6, 2025 answers that question in detail, and the answer

More than a dozen U.S. health systems have issued warnings to patients about an active phishing campaign impersonating Epic MyChart. The emails look legitimate, the brand is trusted, and patients are clicking. Behind each of those clicks sits a potential HIPAA breach notification obligation, a medical identity theft victim, and a regulatory exposure that no cyber liability policy fully absorbs. Background: Why This Campaign Works at Scale Epic holds the patient portal relatio

Most healthcare organizations prepare for an audit the way a student crams for an exam. They pull policies together, refresh a risk assessment, assemble a binder, and hope the questions land where they are strong. Then the proposed HIPAA Security Rule is going to make annual compliance audits a permanent fixture, and cramming does not survive an annual cadence. To pass every year, you have to understand what an auditor is actually looking for, and that looks very different fr

For more than two decades, the HIPAA Security Rule gave healthcare organizations a quiet escape hatch. It was called "addressable." If a safeguard was labeled addressable rather than required, an organization could implement it, implement an equivalent alternative, or document why it was not reasonable and appropriate and move on. In practice, that flexibility became a loophole. Encryption was addressable. Multi-factor authentication lived in the gray space. Entire security p

When #CISA, #HHS, and the #FBI issue a joint advisory naming a specific ransomware group and calling out healthcare as a targeted sector, that is not a signal to schedule a review meeting. It is a directive to validate your controls this week. The #Medusa ransomware group has compromised more than 500 critical infrastructure organizations, and the federal government has been unambiguous: healthcare is in the target set. The question for every health plan, hospital system, and

The Aesto Health data security incident is not a vendor problem. It is a governance problem, and every healthcare CIO, CISO, and board member who reads past the headline as though it belongs to someone else is making a strategic mistake. Aesto Health, a Birmingham, Alabama-based healthcare technology company, recently disclosed a breach that has compromised the protected health information of patients across multiple provider clients. The details are still emerging, but the p

Five healthcare providers have reached class action settlements in the past eighteen months over one issue: marketing teams deployed tracking pixels on patient-facing web properties without security review, without privacy oversight, and without Business Associate Agreements. That is not an IT failure. That is an organizational governance failure, and it carries price tags that belong in every board risk briefing this quarter. The stakes are no longer theoretical. Boards need

A new HIPAA Journal report documents what many of us in healthcare security have been tracking for years: a sustained surge in malicious insider incidents, running alongside a rise in mega data breaches, with 2026 on track to set records across both categories. For health system executives and boards still treating insider threat as an IT checkbox, this data demands a fundamentally different response. The Structural Problem Healthcare Cannot Outspend Healthcare's insider thre

The $18 million multistate settlement reached between 23andMe and a coalition of 42 state attorneys general deserves more than a news cycle. For healthcare executives, it is a signal that the regulatory terrain around genomic and sensitive health data has permanently shifted, and most organizations are not positioned to respond. Background: Genomics Has Entered the Care Delivery Stack The 23andMe breach originated in October 2023 through a credential stuffing attack that expo

Charlotte-Mecklenburg Hospital Authority, operating as Atrium Health, recently agreed to pay up to $1.8 million to resolve a class action lawsuit arising from tracking pixels deployed on its patient-facing web properties. Those pixels transmitted protected health information to Meta, Google, and other advertising platforms without authorization. If your health system still has an unchecked pixel footprint on its website or patient portal, you are carrying a liability your boa

Marlboro-Chesterfield Pathology has just received preliminary court approval to settle a class action arising from a ransomware breach that hit the organization in January 2025. The attack is 18 months in the rearview mirror. The legal and financial consequences are only now being finalized. For every healthcare executive who still thinks of ransomware as an IT problem that ends when systems are restored, this case is the correction you need. What Actually Happened, and Why t

Researchers have now documented what many of us in healthcare security have been stress-testing as a near-term scenario: a fully autonomous, LLM-driven ransomware agent that conducted a complete attack campaign without a human operator directing a single step. This is not an academic thought experiment. It is an operational preview of the threat environment your security team will face, possibly before your organization's next board meeting. Healthcare executives need to hear