The Acadia Healthcare notice that went out May 22, the Genesis ransomware that hit an independent California cardiology practice, and the 35,000-account phishing campaign Microsoft tracked in April. Same fact pattern, three different scales. The attackers did not break in. They logged in.
•
Jun 9, 2026
A federal court in Chicago ruled last week that patients can sue a healthcare provider over a vendor's data breach. The diligence defense — "they were reputable, they had certifications, I trusted them" — just got materially narrower.
Jun 2, 2026
A Small OB/GYN practice just paid $900,000 to settle a class action over a four-day breach in 2022. The breach itself wasn't extraordinary — what made it expensive was what happened next. Here's the operational document most independent practices don't have, and why it's the difference between $0 and seven figures.
May 30, 2026
A California Supreme Court ruling last week makes it easier to sue any practice that holds a California resident's medical records — including the records of patients who moved there years ago and you haven't seen since.
May 26, 2026
Join the list to receive our newest posts straight to your inbox.
May 23, 2026
May 19, 2026
May 16, 2026
May 12, 2026
May 9, 2026
May 6, 2026
