Loading story…
Cadia Healthcare, a company operating five nursing homes and rehabilitation facilities in Delaware, was fined $182,000 by the U.S. Department of Health and Human Services' Office for Civil Rights (HHS OCR) for violating HIPAA regulations. The violation stemmed from a 'Success Stories' marketing campaign in which Cadia Healthcare posted photos and names of patients on social media platforms without obtaining proper authorization. The campaign was intended to highlight patient recoveries and positive outcomes, but it resulted in the impermissible disclosure of protected health information (PHI) for approximately 150 patients. The HHS OCR investigation was initiated after a complaint was filed in September 2021, alleging that Cadia had posted a complainant's photo, name, and details about their medical conditions, treatment, and recovery on its website. The investigation confirmed that a Cadia employee had posted the complainant's information as part of the campaign without securing a signed authorization. Regulators determined that these actions constituted a clear breach of HIPAA privacy rules, which require explicit patient consent before sharing PHI for marketing or publicity purposes. The fine imposed reflects the seriousness of the violation and the number of individuals affected. Cadia Healthcare operates multiple facilities providing skilled nursing, rehabilitation, and long-term care, making the scope of the breach significant within the healthcare sector. The case underscores the importance of strict adherence to privacy regulations when handling patient information, especially in the context of marketing and social media. HHS OCR emphasized that healthcare organizations must implement robust policies and training to prevent unauthorized disclosures of PHI. The incident serves as a warning to other healthcare providers about the risks of using patient information in promotional materials without proper consent. The regulatory response included not only the financial penalty but also requirements for Cadia to improve its privacy practices and staff training. The breach highlights ongoing challenges in balancing patient privacy with organizational marketing efforts in the digital age. Healthcare entities are reminded that even well-intentioned campaigns can result in significant regulatory and reputational consequences if privacy laws are not strictly followed. The case also demonstrates the effectiveness of the complaint process in bringing privacy violations to the attention of regulators. Cadia Healthcare's experience is likely to prompt other organizations to review their own policies regarding the use of patient information online. The incident reinforces the critical need for healthcare providers to obtain explicit, documented consent before sharing any patient-related content publicly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The Dutch Data Protection Authority imposed a €182,000 fine on a nursing home for unlawfully posting patient photos online, indicating a privacy violation involving residents' personal data. The references do not provide a more specific event date beyond the publication date.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare organizations across the United States have reported significant data breaches affecting the personal and protected health information of hundreds of thousands of patients and employees. Notable incidents include the compromise of NCH Corporation Employee Benefits Plan data via exploitation of a zero-day vulnerability in Oracle E-Business Suite, a ransomware attack on OrthopedicsNY resulting in a $500,000 fine by the New York Attorney General, and a major breach at Murfreesboro Medical Clinic & SurgiCenter attributed to the BianLian ransomware group. Other breaches involved unauthorized access to patient data at Fyzical Therapy & Balance Centers, exposure of client data through a law firm serving Goldman Sachs, and improper storage of thousands of medical records in a Memphis storage unit. Additionally, Health Share of Oregon and CareOregon notified members of unauthorized viewing of their information, though the exact nature of the incident remains unclear. Regulatory responses have included state attorney general enforcement actions, such as the fine imposed on OrthopedicsNY for failing to implement adequate cybersecurity measures. Organizations affected by these breaches have taken steps such as patching vulnerabilities, enhancing security policies, notifying affected individuals, and offering credit monitoring services. The incidents highlight ongoing risks to healthcare data security from ransomware, insider threats, third-party exposures, and improper data handling, as well as the increasing role of state regulators in enforcing HIPAA compliance and data protection standards.
Jun 29, 2026
Multiple healthcare organizations have reported significant data breaches involving unauthorized access to patient information. CareOregon and Health Share of Oregon notified patients of a breach where protected health information, including names, dates of birth, health plan details, and Medicaid/Medicare numbers, was accessed without authorization, raising concerns about potential insurance fraud. Canopy Health, a major New Zealand oncology provider, disclosed a cyberattack that resulted in unauthorized access to administrative systems and possible data exfiltration, with the incident being contained and legal action taken to prevent misuse of the compromised data. Additionally, a Manhattan plastic surgery practice suffered a cyberattack in which sensitive patient images and personal information were stolen and published online, with extortion attempts made directly to patients; this attack is linked to a series of similar incidents targeting plastic surgery practices. In parallel to these incidents, California authorities have taken regulatory action against Datamasters, a marketing firm found to be illegally selling health and personal data of millions of individuals without proper registration as a data broker. The company was fined and banned from selling Californians' personal information after it was discovered to have traded in sensitive data, including health conditions and demographic details, for targeted advertising. These events highlight ongoing risks to health data privacy from both cyberattacks and improper commercial data practices, as well as the increasing regulatory scrutiny and enforcement in this sector.
Jun 29, 2026
Several healthcare organizations, including Cerebral, RAYUS Radiology, Sutter Health, Lemonaid Health, and Redeemer Health, have reached settlements in class action lawsuits related to their use of website tracking technologies such as pixels. These lawsuits alleged that the use of such tools resulted in the unauthorized disclosure of personally identifiable and protected health information to third parties like Meta and Google, without patients' knowledge or consent. The settlements provide financial compensation and, in some cases, service credits to affected individuals, with eligibility typically based on prior notification of the data breach. The legal actions stem from concerns that website tracking technologies, when used on healthcare websites, can transmit sensitive health information to external parties, potentially violating HIPAA and other privacy laws. The U.S. Department of Health and Human Services issued guidance on the use of these tools, emphasizing that they should not be deployed on authenticated patient portals without proper authorization or agreements. The settlements reflect a growing trend of litigation and regulatory scrutiny over the intersection of digital marketing technologies and healthcare privacy obligations.
Jun 30, 2026