From ClingantryAI Health Regulator News

iRhythm Technologies, Inc., a healthcare provider in California, submitted a breach report to HHS OCR on 10/03/2026. The incident involved a hacking/IT incident targeting a network server. This breach potentially exposed the protected health information of 8,179,772 individuals. As a covered entity, iRhythm is responsible for notifying affected individuals and the government. Healthcare administrators should review their own vendor contracts and security protocols, especially if they interact with iRhythm or similar device manufacturers, to ensure adequate safeguards are in place against similar cyber threats.

A California Court of Appeal has ruled that out-of-network reimbursement rates are not exempt from state antitrust laws. The court reversed a lower court decision in a case brought by VHS Liquidating Trust, the bankruptcy liquidator for the former Verity Health System. VHS alleged that MultiPlan Corporation (now Claritev) engaged in price-fixing. The court describes MultiPlan as a company that “uses proprietary algorithms to suggest the reimbursement rates insurers and other third-party payors should pay” for out-of-network care. The appellate court held that payments for out-of-network services are prices under the Cartwright Act, meaning they can be subject to antitrust liability if fixed or tampered with. The ruling lets the case proceed; the price-fixing claims remain allegations.

HHS OCR received a breach filing from the Gay & Lesbian Community Services Center of Orange County, Inc., a healthcare provider in california. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 75,532 individuals were affected. The submission date recorded is 06/05/2026. This date reflects when the report was submitted to the regulator, not when the breach occurred or was discovered. Healthcare administrators should review this filing to understand the scope of incidents involving community health centers and ensure their own incident response protocols align with current reporting timelines.

North East Medical Services, a healthcare provider in California, submitted a breach report to HHS OCR on 12/18/2025. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 91,513 individuals were affected. This submission date reflects when the report was filed, not necessarily when the breach occurred. Providers in California should review their cybersecurity posture, particularly regarding network servers, to ensure adequate protection against unauthorized access.