Loading story…
New York State has implemented new cybersecurity regulations for general hospitals that surpass the requirements of the federal HIPAA security rule. These state-level regulations mandate a broader scope of data protection, extending beyond protected health information to include personally identifiable information, business data, and other sensitive categories. Hospitals are now required to report cyber incidents to the state health department within 72 hours, a rule that became effective in October 2024. The full suite of regulations, which came into force on October 1, 2025, imposes comprehensive requirements such as mandatory multifactor authentication, thorough risk analysis, the appointment of a Chief Information Security Officer (CISO), and the establishment of robust incident response protocols. Compliance with these regulations presents significant challenges for healthcare providers, particularly in identifying and governing the expanded set of sensitive data that must be protected. The regulations demand that hospitals conduct detailed risk assessments to determine what data needs protection and how to safeguard it effectively. The scope of the rules means that hospitals must now consider a wider array of threats and vulnerabilities, not just those related to HIPAA-covered data. The new requirements also necessitate updates to existing security policies and procedures, as well as increased investment in cybersecurity technologies and staff training. Hospitals must ensure that their incident response plans are capable of meeting the 72-hour reporting window, which may require changes to detection and escalation processes. The designation of a CISO is now a formal requirement, emphasizing the need for dedicated leadership in information security. These regulations reflect a growing recognition of the evolving cyber threat landscape facing healthcare organizations. The expanded rules are intended to address not only data breaches but also ransomware attacks, business email compromise, and other sophisticated threats. Compliance is expected to be closely monitored by state authorities, with potential penalties for non-compliance. The new framework aims to improve the overall resilience of New York's healthcare sector against cyberattacks. Hospitals are being urged to review their current security postures and make necessary adjustments to align with the state's heightened expectations. The regulations are seen as a model that could influence cybersecurity standards for healthcare providers in other states. Ultimately, the goal is to better protect patient data, business operations, and public trust in the healthcare system.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
New York hospitals became subject to cybersecurity requirements described as tougher than federal HIPAA standards, marking a state-level regulatory escalation for healthcare organizations. The references indicate this as the central real-world development but provide no additional dated milestones or implementation details.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare organizations across the United States have reported significant data breaches affecting the personal and protected health information of hundreds of thousands of patients and employees. Notable incidents include the compromise of NCH Corporation Employee Benefits Plan data via exploitation of a zero-day vulnerability in Oracle E-Business Suite, a ransomware attack on OrthopedicsNY resulting in a $500,000 fine by the New York Attorney General, and a major breach at Murfreesboro Medical Clinic & SurgiCenter attributed to the BianLian ransomware group. Other breaches involved unauthorized access to patient data at Fyzical Therapy & Balance Centers, exposure of client data through a law firm serving Goldman Sachs, and improper storage of thousands of medical records in a Memphis storage unit. Additionally, Health Share of Oregon and CareOregon notified members of unauthorized viewing of their information, though the exact nature of the incident remains unclear. Regulatory responses have included state attorney general enforcement actions, such as the fine imposed on OrthopedicsNY for failing to implement adequate cybersecurity measures. Organizations affected by these breaches have taken steps such as patching vulnerabilities, enhancing security policies, notifying affected individuals, and offering credit monitoring services. The incidents highlight ongoing risks to healthcare data security from ransomware, insider threats, third-party exposures, and improper data handling, as well as the increasing role of state regulators in enforcing HIPAA compliance and data protection standards.
Jun 29, 2026
A cyberattack on NS Support LLC, a neurosurgical healthcare provider, resulted in unauthorized access to its network and the exfiltration of files containing protected health information (PHI) for nearly 93,000 patients. The compromised data included names and medical notes, but not Social Security numbers or financial information. In response, NS Support wiped and rebuilt affected systems, implemented additional security measures, and began reviewing and updating its data security policies. Notification letters were sent to affected individuals, and the incident was reported to the Department of Health and Human Services Office for Civil Rights (HHS OCR). The healthcare sector continues to face a surge in data breaches, with over 700 large incidents reported annually from 2021 to 2024, compromising the PHI of more than 595 million individuals. Hacking and IT incidents are the primary causes, often facilitated by employee errors or lapses in cyber hygiene. Experts highlight the growing complexity of healthcare data ecosystems, especially with the rise of telehealth, and emphasize the need for robust data classification, continuous monitoring, and adaptive security controls to protect sensitive patient information. Regulatory frameworks like HIPAA remain central, but organizations must go beyond compliance to ensure comprehensive data protection across diverse platforms and partners.
Jun 29, 2026
Several healthcare providers in the United States have recently disclosed significant data breaches resulting from cyberattacks, with patient and employee information being compromised. AllerVie Health, based in Texas, confirmed unauthorized access to its network, exposing sensitive data such as names, Social Security numbers, and insurance details, allegedly due to a ransomware attack by the Anubis group. The attackers claim to have stolen records of over 30,000 patients, and affected individuals have been offered credit monitoring and identity theft protection. In a separate incident, OrthopedicsNY, a healthcare provider in New York, suffered a breach in 2023 after attackers gained remote access using compromised credentials, leading to the exposure of data belonging to more than 650,000 patients and employees. The New York Attorney General secured a $500,000 penalty from OrthopedicsNY for failing to implement adequate security measures, and the provider is now required to enhance its data protection practices. Additionally, Singing River Health System in Mississippi reported a cyber incident that led to the temporary shutdown of its patient portal and internet access as a precaution. While the threat was reportedly mitigated, the investigation is ongoing to determine if patient records were accessed. These incidents highlight the ongoing risks faced by healthcare organizations from ransomware groups and other cybercriminals, as well as the increasing regulatory scrutiny and financial penalties for failing to protect sensitive health information. Impacted organizations are responding with offers of credit monitoring and reviews of their security policies, but the breaches underscore the need for robust cybersecurity measures in the healthcare sector.
Jun 29, 2026