Loading story…
HHS Secretary Robert F. Kennedy Jr. has reportedly sought access to Americans’ medical records since spring 2025 for research into his claimed vaccine-autism link, despite the scientific consensus that vaccines do not cause autism. The effort would place highly sensitive, identifiable health data in a centralized repository, raising concerns over breach exposure, secondary uses without consent, reidentification, and potential government misuse.
HIPAA limits how covered health providers, insurers, and their business associates may use or disclose protected health information, but it does not universally protect health data—particularly information generated outside covered entities or data after it leaves their systems. Critics also question assurances that records can be safely anonymized: research published in June 2026 found uneven protection against membership-inference attacks on AI models, while U.S. health-aid agreements with countries including Uganda and Kenya have reportedly sought access to national health-data systems under contested anonymization terms.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
A June 2026 Nature study assessed membership-inference attacks against AI diagnostic models trained on chest X-rays, electrocardiograms, and electronic health records. It found that some patients faced near-certain reidentification risk and that underrepresented groups faced disproportionate risk despite low average identification rates.
Since spring 2025, HHS Secretary Robert F. Kennedy Jr. has sought federal access to Americans' medical records to investigate a claimed link between vaccines and autism. HHS reportedly approached state health information exchanges about using identifiable patient records for the research.
Kenya made a health-data access agreement with the United States similar to Uganda's, while Zambia, Zimbabwe, and Ghana declined the initial terms. The U.S. government said data obtained through the foreign agreements would be aggregated and anonymized.
Under the Trump administration's global health plan, Uganda agreed to provide the United States real-time access for seven years to nine health-data systems in exchange for up to $1.7 billion over five years. The agreement reportedly includes access to Uganda's central health-information repository and individual electronic medical-record system.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Electronic Privacy Information Center (**EPIC**) released a report, *Beyond HIPAA: Reimagining How Privacy Laws Apply to Health Data to Maximize Equity in the Digital Age*, warning that US health privacy protections are failing as health-related data is increasingly collected outside clinical settings and repurposed for commercial profiling and government use. EPIC argues that **outdated laws (including HIPAA’s limited scope)** and weak regulation of digital tracking enable health data to be harvested via apps, websites, location tracking, and online searches, then aggregated and sold—supporting targeted advertising, “surveillance pricing,” and other uses that can raise costs or restrict access to care. The report and related coverage highlight that health data can escape medical contexts and be used for **surveillance and enforcement**, including scenarios where immigration enforcement activity in or around medical facilities deters patients from seeking treatment. EPIC frames the issue as a “health privacy crisis” that undermines trust and worsens outcomes, particularly for marginalized communities, and points to **data brokers** and the broader commercial surveillance ecosystem as central drivers of the problem; EPIC also promoted a public event discussing the report’s findings and recommendations.
Jun 29, 2026
Additional confidential UK Biobank volunteer health records were posted on Alibaba-linked Chinese websites after an initial breach, prompting UK officials to warn that more leaks may follow and to work with Chinese authorities on takedowns. Science minister Patrick Vallance said three Chinese hospitals were understood to be behind the postings. The exposed information relates to the **UK Biobank** research database covering about **500,000 volunteers**, and access to the dataset was temporarily suspended after the breach was disclosed, reportedly by an anonymous whistle-blower. Officials described the leaked records as de-identified, but warned that combining large datasets could still enable re-identification. The disclosures intensified scrutiny of UK Biobank’s longstanding data-sharing arrangements with Chinese researchers. Earlier reporting found that **265 of 1,375** approved UK Biobank access applications came from China, and that Chinese researchers were permitted to apply for access to linked UK GP records through a controlled-access platform. Critics had already warned that health and genomic data could be strategically valuable for biotechnology, surveillance, and intelligence purposes, particularly given concerns over China’s national intelligence law. Separate reporting also pointed to at least **30 other UK Biobank-related breaches** in a single month, including a dataset on **96,000 volunteers** that was reportedly uploaded by a Yale University master’s student and remained online.
Jun 29, 2026
An audit by the Utah State Auditor found **critical privacy and security weaknesses** at the Utah Department of Health and Human Services (DHHS), following a whistleblower complaint alleging inadequate incident response procedures and insufficient monitoring to detect and manage privacy incidents. The review focused on two high-sensitivity systems—**SAFE** (Utah’s child welfare case management system, reported to contain ~6 million records tied to >2 million individuals) and **eChart** (a mental health records repository maintained by the Utah State Hospital)—and concluded that gaps in documentation, controls, and oversight increase the risk of unmitigated exposure of sensitive data, particularly children’s information. Separately, British Columbia’s Office of the Information and Privacy Commissioner reported **intentional “snooping”** by healthcare staff into patient records following the Lapu Lapu Day festival tragedy, with 71 unauthorized access incidents affecting the medical records of 16 individuals and attributed to 35 employees across multiple health authorities (plus one physician-office assistant). In contrast, HIPAA Journal’s reminder about the **March 1, 2026** deadline for reporting “small” (<500 individuals) healthcare breaches to HHS OCR is primarily compliance guidance rather than a specific incident, though it underscores regulatory expectations for timely breach notification and the risk of penalties and compliance investigations for late reporting.
Jun 29, 2026