NetSec.news

Boone Health and CH Allied Services have agreed to settle class action litigation alleging that third-party tracking technologies used in the Boone Health patient portal transmitted patient information to third parties without consent. The case is Doe, et al. v. Boone Health, Inc., et al., Case No. 22AC-CC07646, in the Circuit Court of Cole County, 19th Judicial Circuit, State of Missouri. The defendants are Boone Health, Inc. d/b/a Boone Health, CH Allied Services, Inc.

Veradigm disclosed that a cybersecurity incident involving a third-party vendor allowed an unauthorized party to access and copy patient personal information for a small number of its customers. Practice management and EHR company, Veradigm in Chicago, Illinois is formerly known as Allscripts. Healthcare Solutions. The HIPAA-covered entity reported the incident in a Form 8-K filing with the U.S. Securities and Exchange Commission on September 8, 2026.

A survey of almost 5,000 U.S. adults found that most patients want healthcare providers to disclose when and how artificial intelligence tools are used in connection with their healthcare. The survey was conducted by the Pew Research Center in late June 2026. It found that 72% of respondents considered it extremely important or very important for healthcare providers to disclose whether AI tools are being used in connection with healthcare.

Clay-Platte Family Medicine and Barry Pointe Family Care in Kansas City, Missouri, and Nathan D. Granger, dba Summit Family and Sports Medicine in Harrisonville, Missouri, and Cobblestone Family Medicine Clinic dba Clay Platte Family Medicine Clinic have agreed to a $1,000,000 settlement resolving consolidated class action litigation arising from a June 2024 data breach involving the electronic protected health information (ePHI) of 53,916 individuals.

Clover Health Investments is investigating a cybersecurity incident involving unauthorized access to three employee email accounts after employees disclosed their login credentials through a social engineering attack, and the company is evaluating whether personal information or protected health information (PHI) was exposed. Clover Health Investments reported the cybersecurity incident to the U.S. Securities and Exchange Commission.

A settlement has been agreed to resolve class action litigation related to a data breach at Total Vision LLC, and the settlement has received preliminary approval from the court. Total Vision LLC owns a network of optometry centers located in California. The litigation relates to a hacking incident that occurred on or around October 30, 2020, when hackers accessed a database server containing patient information.

Memorial Healthcare Services has agreed to settle a class action lawsuit concerning the use of pixels and other tracking, web analytics, and advertising technologies on its website, subject to court approval, with a settlement fund of $750,000 for eligible class members. The lawsuit concerns the use of pixels and other tracking, web analytics, and advertising technologies on the Memorial Healthcare Services website.

Allina Health System has agreed to pay $12.5 million to resolve litigation alleging that website tracking technologies disclosed personally identifiable information (PII) and protected health information (PHI) to third parties, while the health system continues to deny wrongdoing and liability. Nonprofit health system, Allina Health System, based in Minneapolis, Minnesota reached a proposed settlement in litigation concerning its use of website tracking technologies, including pixels.

iRhythm Holdings Inc., a publicly traded manufacturer of heart monitoring devices, disclosed a cybersecurity incident involving unauthorized access to business applications hosted on a third-party platform. The incident was first identified on June 8, 2026 and was reported to the U.S. Securities and Exchange Commission through a regulatory filing.

Bartholomew County Public Hospital doing business as Columbus Regional Health has agreed to settle a class action lawsuit alleging that confidential patient information was disclosed to third-party tracking technologies through its website without patient consent. Columbus Regional Health denies the allegations and states that it agreed to resolve the litigation to avoid the expense, burden, and uncertainty of continued legal proceedings.