Loading story…
Baptist Hospital in Jay, Florida, is facing multiple lawsuits after staff members allegedly took and posted humiliating photos of patients on social media without their consent. The incidents reportedly involved four employees who used personal phones to photograph patients while they were sedated, asleep, or in a semi-nude state, with no medical justification for the images. The hospital terminated the employees following an internal investigation, and at least three patients have filed lawsuits, with the potential for additional legal action.
The law firm representing the patients asserts that the photos were taken and shared intentionally, violating patient privacy and data security. The lawsuits allege that the actions were conducted without the knowledge or consent of the affected individuals, raising significant concerns about data privacy practices and the safeguarding of sensitive patient information within healthcare environments.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Patients filed a lawsuit against a Florida hospital alleging that humiliating photos were posted, according to reporting published on 2025-10-28. No earlier discrete events are described in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cadia Healthcare, a company operating five nursing homes and rehabilitation facilities in Delaware, was fined $182,000 by the U.S. Department of Health and Human Services' Office for Civil Rights (HHS OCR) for violating HIPAA regulations. The violation stemmed from a 'Success Stories' marketing campaign in which Cadia Healthcare posted photos and names of patients on social media platforms without obtaining proper authorization. The campaign was intended to highlight patient recoveries and positive outcomes, but it resulted in the impermissible disclosure of protected health information (PHI) for approximately 150 patients. The HHS OCR investigation was initiated after a complaint was filed in September 2021, alleging that Cadia had posted a complainant's photo, name, and details about their medical conditions, treatment, and recovery on its website. The investigation confirmed that a Cadia employee had posted the complainant's information as part of the campaign without securing a signed authorization. Regulators determined that these actions constituted a clear breach of HIPAA privacy rules, which require explicit patient consent before sharing PHI for marketing or publicity purposes. The fine imposed reflects the seriousness of the violation and the number of individuals affected. Cadia Healthcare operates multiple facilities providing skilled nursing, rehabilitation, and long-term care, making the scope of the breach significant within the healthcare sector. The case underscores the importance of strict adherence to privacy regulations when handling patient information, especially in the context of marketing and social media. HHS OCR emphasized that healthcare organizations must implement robust policies and training to prevent unauthorized disclosures of PHI. The incident serves as a warning to other healthcare providers about the risks of using patient information in promotional materials without proper consent. The regulatory response included not only the financial penalty but also requirements for Cadia to improve its privacy practices and staff training. The breach highlights ongoing challenges in balancing patient privacy with organizational marketing efforts in the digital age. Healthcare entities are reminded that even well-intentioned campaigns can result in significant regulatory and reputational consequences if privacy laws are not strictly followed. The case also demonstrates the effectiveness of the complaint process in bringing privacy violations to the attention of regulators. Cadia Healthcare's experience is likely to prompt other organizations to review their own policies regarding the use of patient information online. The incident reinforces the critical need for healthcare providers to obtain explicit, documented consent before sharing any patient-related content publicly.
Jun 29, 2026
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026
Personal information about medical professionals, including doctors and nurses, is widely available on people search sites, according to research by Incogni. The study found that 97% of doctors from major U.S. hospitals had profiles on at least one data broker site, with many appearing on multiple platforms. This widespread exposure increases the risk of harassment, unwanted contact, and potential physical harm, especially as sensitive details like home addresses and phone numbers are easily accessible. The level of exposure varies by state, age, and gender, with older doctors and those in certain states facing higher risks. The findings highlight the growing challenge for healthcare organizations to protect staff privacy and safety in an era of rampant data aggregation. In addition to external data exposure, healthcare organizations face significant insider threats, particularly from employees snooping into patient records without authorization. Insider access can be motivated by curiosity, personal relationships, or malicious intent, such as identity theft or public embarrassment. A recent case involving the University of Miami Health System (UHealth) underscores the difficulty in preventing and detecting such incidents, as well as the reluctance of some institutions to share lessons learned. Addressing both external and internal privacy risks is critical for healthcare leaders to safeguard their workforce and maintain trust in clinical operations.
Jun 29, 2026