Latest cybersecurity reporting from selected sources.

Patients Allege Health Entities Did Not Get Consent to Record ConversationsProposed federal class action litigation alleges that two California healthcare organizations violated patient privacy in their use of an AI-enabled ambient tool that records, transcribes, and processes sensitive conversations between clinicians and patients without individuals' consent.

White House Criticizes Cyber Defense Agency - and Proposes a Steep $700 Million CutThe FY2027 proposal would cut roughly $707 million from CISA, reducing staffing, contractor support and coordination programs while shifting the agency toward a narrower focus on federal networks and critical infrastructure amid rising nation-state cyberthreats.

CHIME, AHA, Others Contend Privacy, Security Burden Would Shift to ProvidersProposals to eliminate certain longstanding health IT certification criteria - including privacy and security related controls - will shift regulatory burden from health IT developers to healthcare providers, some industry groups contend in their public response to proposed federal rulemaking.

Bipartisan Bill Would Mandate Multifactor Authentication, Pen TestingProposed legislation that's been kicking around Congress for the last few years that aims to help bolster cybersecurity of the healthcare sector cleared a critical hurdle on Thursday. But will the bill gain enough momentum to pass the full Senate, the House and be signed into law?

Revised Cybersecurity Act Would Also Boost ENISACountries across the EU could be forced to kick Chinese telecom manufacturers such as Huawei and ZTE out of their critical infrastructure supply chains, under a far-reaching proposal published by the European Commission on Tuesday.

The European Commission has proposed new cybersecurity legislation mandating the removal of high-risk suppliers to secure telecommunications networks and strengthening defenses against state-backed and cybercrime groups targeting critical infrastructure. [...]

Healthcare cyberattacks are on the rise, but industry organizations say the proposed changes to the security rules fall short of what's needed.

The UK government’s proposed ransomware payment ban for public sector and critical infrastructure will come with national security exemptions

March Breach Affected Nearly 5.6 Million; NextGen Proposed Settlement Also ReachedConnecticut's largest healthcare network - Yale New Haven Health System - has agreed to pay $18 million to settle class action litigation filed in the aftermath of a March hack affecting nearly 5.6 million people. The incident ranks as the biggest health data breach reported so far in 2025.

Bayhealth Medical Center Was Among Cybercrime Group's Many 2024 Healthcare VictimsBayhealth Medical Center in Delaware - an alleged victim of a 2024 hack by the "notorious" and prolific ransomware gang Rhysida that resulted in a breach affecting nearly a half-million people - has agreed to a preliminary settlement in a proposed class action lawsuit stemming from the incident.

Class Action Litigation Accused Mt. Sinai of Sending Patient Info to FacebookA New York City healthcare system has agreed to pay nearly $5.3 million to settle a proposed class action lawsuit alleging that the hospital's use of online tracking tools in its patient portal and website sent patient information to Facebook without their knowledge or consent for years.

Lawsuit Claims BJC Health Shared Patient Info From MyChart Portal Without ConsentA Missouri healthcare system has agreed to pay up to $9.25 million to settle a proposed class action lawsuit alleging that its use of online tracking tools in its patient portals transmitted sensitive patient information to third-party firms without the patients' knowledge or consent.

Labour Government Also Backs Ransomware Payment Clearance and ReportingThe British government vowed Tuesday to proceed with a proposed ransomware payment ban for critical infrastructure organizations such as the National Health Service and to press forward on a mandate for other businesses to notify authorities in advance of paying out a ransom.

Several Affected HealthEC Healthcare Clients Are Chipping in to Fund SettlementA provider of artificial intelligence-enabled hospital cost-cutting software and several of its healthcare clients agreed to $5.48 million to settle proposed class action litigation involving a 2023 hacking incident affecting 4.6 million individuals.

Financially Strapped Cloud Services Firm Settles Suit From 2020 Patient Data HackA financially strapped cloud services vendor that experienced a 2020 ransomware attack affecting dozens of healthcare sector clients and hundreds of thousands of patients has agreed to a $1.9 million settlement in proposed class action litigation involving the data theft case.

Healthcare and IT security practitioners worry some of the proposed amendments are not practical for a sector that lacks resources and often uses legacy equipment.

Cybersecurity Wonks Find Fault With Home Office Ransomware ProposalsA collection of British cybersecurity policy wonks poured cold water over a British government proposal to outlaw ransom payments by government agencies and from regulated operators of critical infrastructure. A ban wouldn't likely represent a significant blow to ransomware profits.

The Health Sector Coordinating Council is urging the Trump administration to drop work on a proposed HIPAA security rule update and instead engage in a collaborative dialogue with healthcare sector leaders to create alternative cyber requirements, said Greg Garcia, executive director of HSCC.

Health Industry Associations Complain That Proposed Cyber Mandates Are 'Staggering'Seven major healthcare industry groups are urging the Trump administration to rescind a proposed update to the HIPAA security rule issued at the end of the Biden administration. The costs and regulatory burden to comply would be "staggering" to the healthcare sector, they said.

7 Proposed Class Actions Filed Against Allegheny Health Network and IntraSystemsA Pittsburgh-based healthcare system and its Massachusetts-based IT services firm are facing at least seven proposed federal class action lawsuits involving a data theft - reported on Jan. 17 - affecting about 293,000 people. The hack is the latest major breach involving a business associate.