Negligence or Neglect? Healthcare Data Breach Security Standards

By William B. Federman, Managing Partner, Federman & Sherwood, Oklahoma City · Admitted in Oklahoma (1982), New York (1988) and Texas (1995) | Updated November 2026

When a hospital, clinic or medical billing company loses control of patient data, the people affected usually learn about it from a letter weeks or months later. By then, names, Social Security numbers, insurance details and medical histories may already be circulating. Healthcare records are attractive to criminals because they combine identity and financial information with details that cannot be changed, such as a diagnosis or date of birth.

A breach alone does not make a healthcare organization legally responsible. The harder question is whether the organization took reasonable steps to protect the data. That is where the line between ordinary carelessness and a more serious failure to act starts to matter.

The Scale of the Problem

Healthcare organizations report large breaches to the U.S. Department of Health and Human Services, which publishes them on its breach portal. The largest so far, the 2024 ransomware attack on Change Healthcare, affected about 192.7 million people, according to the company’s revised report to HHS in July 2025. Reporting on that attack said the attackers got in through a remote-access portal that did not require multi-factor authentication, a basic safeguard.

A Breach Is Not Automatically a Legal Wrong

To recover damages in most data breach lawsuits, patients have to show that the organization owed them a duty to protect their information, that it fell short of that duty, and that the failure caused real harm. Most claims are built on negligence, often alongside breach of implied contract, unjust enrichment and state consumer protection laws.

Several common assumptions about this area of law are wrong:

• HIPAA does not let patients sue. The federal HIPAA rules set security standards for healthcare providers, health plans and their vendors, but enforcement belongs to HHS and state attorneys general, not individuals. HIPAA standards are still important in a lawsuit because they help show what reasonable security looks like.
• Most state privacy laws do not create a private lawsuit either. The Texas Data Privacy and Security Act, for example, is enforced only by the Texas Attorney General. California is an exception: Civil Code section 1798.150 lets consumers sue when certain unencrypted personal information is stolen because a business failed to keep reasonable security, with statutory damages available.
• Every state has a breach notification law, but those laws mainly govern when and how people must be told, not whether they can recover money.

Harm is often the most contested element. In TransUnion LLC v. Ramirez (2021), the U.S. Supreme Court held that plaintiffs in federal court must show a concrete injury, not just a legal violation. In breach cases, courts look at things like actual misuse of the data, money spent on credit monitoring or fraud recovery, time lost dealing with the breach, and whether the stolen information is the kind that makes future misuse likely.

What “Reasonable Security” Looks Like in Healthcare

The HIPAA Security Rule does not list a single checklist. It requires covered healthcare organizations and their business associates to assess their own risks and adopt safeguards that fit. Those safeguards fall into three groups:

• Administrative safeguards: a documented risk analysis, a plan to manage the risks it finds, workforce training, access controls and incident response procedures.
• Technical safeguards: controls on who can access electronic health information, audit logs, integrity protections and secure transmission. Encryption is technically “addressable” under the current rule, which means an organization must use it or document why an equivalent measure is reasonable.
• Physical safeguards: securing facilities, workstations and devices, and properly disposing of hardware and paper records.

Standards are moving toward stricter expectations. In January 2025, HHS proposed updates to the Security Rule that would require multi-factor authentication and encryption in most cases and make other safeguards mandatory. As of late 2026, that proposal had not been finalized, but it reflects how regulators now view basic security practices.

Vendors are a frequent weak point. Many of the largest recent breaches began at billing companies, IT providers or software vendors rather than at hospitals themselves. HIPAA requires healthcare organizations to sign business associate agreements that bind vendors to protect patient data. Whether the provider is also legally responsible for a vendor’s failure depends on the facts, including how carefully it chose and monitored the vendor, and in many cases both are named as defendants.

Negligence: Falling Short of Reasonable Care

Negligence means failing to act as a reasonably careful organization would under the same circumstances. It does not require bad intent. In healthcare breach cases, examples often include:

• leaving a known software vulnerability unpatched
• allowing remote access without multi-factor authentication
• storing sensitive data unencrypted or longer than necessary
• skipping or ignoring a required risk analysis
• giving employees broader access to records than their jobs require

Delayed notice is a related but separate issue. Under the HIPAA Breach Notification Rule, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. A late notice does not cause the breach, but it can increase harm by giving criminals more time to use the data before patients freeze credit or change accounts, and it can support regulatory penalties and additional claims.

Neglect: Knowing the Risk and Doing Nothing

“Neglect” is not a formal legal category, but it describes a real pattern. Some organizations are warned about a specific risk through an audit, a prior incident or a regulator, and still fail to act. Courts may treat that kind of conduct as gross negligence or recklessness rather than ordinary negligence.

The difference can affect the case. Many states allow punitive damages only when a defendant acted with gross negligence, recklessness or malice, and the standards vary widely from state to state. Evidence that an organization ignored known warnings can also shape settlement talks, since defendants are often reluctant to put that kind of record in front of a jury.

Evidence of neglect usually comes out during discovery: internal emails, past risk assessments, unaddressed audit findings and vendor security reports. That is one reason early preservation of evidence matters in these cases.

What a Healthcare Breach Settlement Can Look Like

Most healthcare data breach class actions end in settlement rather than trial. One recent example among the settlement notices Federman & Sherwood has published involved an ear, nose and throat practice whose October 2024 breach affected about 65,630 people. The proposed settlement, preliminarily approved in March 2026, allowed class members to claim up to $5,000 in documented out-of-pocket losses and up to $80 for time spent responding to the breach, with a claim deadline in July 2026.

Settlement terms like these often depend on how much of the class can show documented losses, the type of data exposed, the defendant’s security practices and the size of available insurance. Past results do not guarantee a similar outcome in any other case.

Steps to Take After a Healthcare Breach Notice

• Read the notice carefully and keep it. Note what data was exposed and the date of the breach.
• Enroll in any free credit monitoring offered, and consider a credit freeze with all three credit bureaus.
• Review explanation-of-benefits statements for treatment you never received, which can signal medical identity theft.
• Keep receipts and a time log for anything you spend dealing with the breach.
• Watch for settlement notices by mail or email, and note claim deadlines.

If you have questions about whether a breach involving your records may support a claim, data breach lawyers can review the notice, the type of data exposed and any losses you have documented.

Disclaimer

This article provides general information about data breach law and is not legal advice. Reading it does not create an attorney-client relationship. Laws on data security, privacy and damages differ by state and change frequently, and the outcome of any claim depends on its specific facts. For advice about your situation, consult a licensed attorney.