Data breaches at health centers and their vendors, HIPAA rulemaking and enforcement, False Claims Act cases and federal audit programs.
The Aesto Health breach, at a vendor that archives retired EHRs, has reached Ocracoke Health Center in North Carolina and Health Access Network in Maine, beyond the vendor's own client list. Lone Star Family Health Center reported 250,130 Texans affected. On September 18 the Justice Department said False Claims Act cases must rest on binding statutes, regulations or contracts, not agency guidance.
As of
Based on: Massachusetts Office of Consumer Affairs and Business… · Texas Office of the Attorney General, Data Security Br… · U.S. Department of Justice, Office of Public Affairs
Timeline
Government · U.S. Department of Health and Human Services
On September 29, 2026, the HHS Office for Civil Rights explained when 42 CFR Part 2 lets state Medicaid agencies use substance use disorder records.
Government · U.S. Department of Health and Human Services
Event:
On September 17, 2026, the HHS Office for Civil Rights settled with Ambry Genetics over a 2020 phishing attack that exposed data on 225,370 people.
Government · U.S. Department of Health and Human Services
HHS OCR announced a $50,000 settlement and two-year corrective-action plan with Azul Vision after investigating a January 2023 medical-record request that was not fulfilled until January 2025.
Government · Massachusetts Office of Consumer Affairs and Business Regulation
Event:
Breach letters posted by Massachusetts regulators on September 18 and 25, 2026 show the Aesto data-archiving breach reached Ocracoke Health Center in North Carolina and Health Access Network in Maine.
News · CT News Junkie
Event:
The Connecticut Department of Social Services disclosed a June 25, 2026 breach at its fiscal agent, Gainwell Technologies, affecting approximately 41,000 HUSKY members.
Aesto Health covered-entity notice
Event:
Aesto Health migrates and archives patient data when a health center replaces its EHR.
Government · U.S. Department of Justice
Event:
The Justice Department revised its Justice Manual on September 18, 2026, so False Claims Act cases rest only on binding statutes, regulations or contracts.
Government · North Dakota Health and Human Services
Event:
North Dakota Medicaid's September 2026 provider newsletter says the federal PERM audit will review Medicaid and CHIP payments made from July 1, 2026, through June 30, 2027. Randomly chosen providers will get record requests in the coming months.
Government · HHS Office of Inspector General
Event:
HHS-OIG issued Advisory Opinion 26-16 on July 9, 2026 (posted July 14) to a requestor it describes in its own words as 'designated as a federally qualified health center…
Industry · The Employer Report / Sullivan & Cromwell
Event:
Executive Order 14398 (signed March 26) prohibits 'racially discriminatory DEI activities' by federal contractors and grantees. The FAR Council must issue implementation guidance by May 25.
Industry · The Employer Report / Sullivan & Cromwell
Event:
Trump signed EO 14398 prohibiting 'racially discriminatory DEI activities' by federal contractors and grantees. FQHCs receiving HRSA Section 330 grants face compliance deadlines: contract clauses (30 days), FAR guidance (May 25), agency reports (July 24).
Government · California DHCS FQHC/RHC Resources
Event:
DHCS maintains the core FQHC/RHC reimbursement and billing resources that California clinics rely on for PPS encounters, Medi-Cal managed care billing, and service-line documentation.
and 17 more organizations
We use Google Analytics, Vercel Web Analytics, and Vercel Speed Insights to improve the site. Select Decline to turn them off in this browser. We honor GPC and Do Not Track. Read our Privacy Policy.