PrivacySignal
Healthcare

EPIC Urges 7th Circuit to Uphold Wiretap Act to Protect Private Communications Containing Sensitive Health Data

EPIC · · US Federal · Healthcare Privacy

EPIC filed an amicus brief in the Seventh Circuit asking the court to treat Edward-Elmhurst Health's use of Meta Pixel on its patient portal as a violation of the federal Wiretap Act. The health system embedded tracking code that automatically sent patient data from its MyChart portal to Meta and other third parties.

Why this matters: When you log into a hospital's patient portal, you expect your information to stay medical. You do not expect it to be quietly handed to Meta. Health systems have been embedding tracking code that does exactly that, often without patients knowing. The Wiretap Act is a serious federal law with real teeth. If courts apply it here, hospitals face meaningful consequences for surveillance-grade data sharing. If they do not, patient portals become one more place where your most sensitive information is harvested and sold.

Who should care: Healthcare professionals · Privacy officers · Compliance · Cybersecurity

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Related stories

Healthcare
Nextgov/FCW · · US Federal

Social Security expands electronic health record sharing to speed up disability claims adjudication

The Social Security Administration has expanded a system that pulls structured electronic health records directly from providers, giving the agency near-instant access to medical data for people applying for disability benefits. The goal is to cut the notoriously long wait times for disability claim decisions.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
HIPAA Journal · · US Federal

American Addiction Centers & Oculus Pathology Disclose Hacking Incidents

American Addiction Centers in Tennessee and Oculus Pathology in Texas have each disclosed separate hacking incidents. Both organizations operate in healthcare, meaning the breached data likely includes sensitive medical and personal information covered under HIPAA.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
HIPAA Journal · · US Federal

We Reviewed 80,300 Healthcare Review Replies. The HIPAA Risk Was Hiding in Plain Sight

A large-scale audit of over 80,000 online review responses from nearly 4,000 medical and dental practices found an estimated 21,000 public replies that likely disclosed patient information in violation of HIPAA. The violations were not hidden in back-end systems — they were sitting in publicly visible responses to patient reviews.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
HIPAA Journal · · US Federal

Data Theft/Extortion Incident Confirmed by Beverly Hills Plastic Surgeon

A Beverly Hills plastic surgeon has confirmed a data theft and extortion incident, joining a string of recent healthcare data breaches that also include SunCloud Health, Minnesota ENT, and several other medical providers.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
HIPAA Journal · · US Federal

Vishing Attack Provides Threat Act with Access to Quantum Health Network

Quantum Health, a healthcare navigation and care coordination company, disclosed a data breach after a vishing attack — a voice-based social engineering scheme — gave threat actors unauthorized access to its network. Heart of America Medical Center was also named in connection with recent breach announcements.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
HIPAA Journal · · US Federal

Data Breaches Announced by Five HIPAA-Regulated Entities

Five healthcare organizations covered under HIPAA have disclosed data breaches, including the Women's Center for Radiology in Florida and Optalis Management Solutions in Michigan, along with three other named entities. The announcements follow standard breach notification requirements under federal health privacy law.

Who should care: Healthcare professionals · Privacy officers · Compliance · Lawyers

#healthcare#regulation Read original →