Weekly feed
15 curated updates · reviewed against primary sources
Health tech company confirms June cyberattack compromised protected health information of its entire customer base, marking one of healthcare's largest data breaches in 2026. Heart monitoring technology company IRhythm Technologies disclosed that a June 2026 ransomware attack resulted in the...
CISA warns that multiple flaws in dcm4chee-arc-light versions 5.35.1 and earlier enable attackers to delete medical images, leak patient data, and disrupt PACS operations without authentication. The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory (ICSMA-26-288-02)...
Sources
CMS’s 2026 proposed rule would let payers automatically use newer versions of required FHIR and USCDI standards as ONC approves them, reducing the need for frequent CMS rule changes. CMS released a CMS.gov resource page outlining the API and standards requirements stemming from the 2020...
Health-ISAC analysis indicates the long-delayed CIRCIA rule will likely publish in December 2026, while HHS appears to be preparing HIPAA Security Rule amendments via the HIS-BSP proposal. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) final rule, long overdue since its...
FDA's new draft guidance expands pre-market testing requirements for robotic-assisted surgical devices to include cybersecurity, human factors, and operating room integration, with comments due November 24. The FDA has published draft guidance on pre-market testing for robotically-assisted...
Unauthorized access to protected health information (PHI) at Mid Florida Dermatology & Plastic Surgery impacts 85,000 patients, highlighting cybersecurity risks in healthcare provider networks. Mid Florida Dermatology & Plastic Surgery filed a breach notification with the U.S.
A novel lawsuit applying healthcare data access rules to social media platforms tests the boundaries of the 21st Century Cures Act's information blocking provisions. Healthcare technology company Dash.fi has filed a lawsuit against Meta Platforms, alleging that the social media giant violated the...
Two healthcare technology companies disclose separate data breaches affecting patient information, highlighting ongoing cybersecurity risks in health IT infrastructure. Healthcare technology company Photon Health, based in New York, and medical provider network company Healthcare Highways, based...
Administrative complexity, not lack of adoption, is now the primary obstacle preventing health plans from delivering the full benefits of value-based care and alternative payment models. Value-based care has moved beyond pilot programs and is now the standard payment approach for most health...
FDA's submission of the MedSun information collection for OMB review signals continued focus on post-market surveillance of medical devices through structured adverse event reporting. The Food and Drug Administration has submitted a proposed information collection request to the Office of...
FDA seeks public comments on safety and design elements for early-phase ibogaine trials as HHS-funded studies in opioid use disorder and PTSD prepare to launch. The FDA is issuing a Request for Information (RFI) to gather public input on the design and safety considerations for early-phase...
AHRQ requests public comment on a proposed revision to its CAHPS Database for Health Plans information collection, with the comment period closing November 4, 2026. The Agency for Healthcare Research and Quality (AHRQ) has announced its intention to request Office of Management and Budget (OMB)...
FDA is opening a public docket to gather comments on statistical methods for rare disease clinical investigations ahead of a RISE workshop to inform future guidance. The FDA has established a public docket (2026-18805) to collect comments on statistical considerations for the design of rare...
NIH seeks public comment on draft policy to modernize biosafety oversight for recombinant and synthetic nucleic acid research. The National Institutes of Health (NIH) has published a draft biosafety policy for research involving biohazards in the Federal Register, proposing to modernize and...
The settlement resolves claims that the clinic failed to protect 12,000 patients' protected health information exposed during a ransomware attack. Twin Cities Pain Clinic has settled class action litigation related to a data breach that occurred in July 2025.