Jessica Davis

This week’s healthcare data breach roundup includes multiple ransomware and data extortion incidents, a ransomware attack on Enzo Biochem, and includes ongoing outages at two hospitals in Idaho and Medford Radiology Group.

New York’s Department of Financial Services hit OneMain Financial with a massive penalty, reflecting the severity of security failures found during an audit tied to multiple data breaches.

After the Supreme Court overturned Roe v. Wade, Google committed to modifying data retention policies for sensitive locations that could put users at risk.

New York’s investigation into Practicefirst Medical after a reported breach impacting 1.2 million individuals found serious security program failures, including a failed software patch.

HIPAA requires entities to disclose breaches within 60 days, but it took 18 months for Apria Healthcare to inform over 1.8 million patients.

The FBI is working with the Louisville-based health network as it works to recover from a May 9 cyberattack. This week’s healthcare data breach roundup also includes a hack of PillPack accounts.

Google must also increase transparency about its location tracking settings, after a Washington state investigation determined consumers didn’t have control over their data privacy.

It’s the largest fine issued under the stringent privacy violation. Under the dispute resolution, Meta is also required to stop transferring data from Facebook to comply with GDPR.

In a new policy statement, the FTC vowed to combat deceptive practices tied to biometric data collection and marketing, while proposing to tighten its FTC Health Breach Notification Rule.

It’s the second proposed action taken under the FTC’s Health Breach Notification Rule and third complaint against a health app developer this year, signaling more developer scrutiny ahead.