In a world where your latte order is more secure than your medical history, HIPAA (The Health Portability and Accountability Act of 1996), the law designed to protect your health information, has never looked more fragile. While patients assume their most intimate details are protected behind virtual vaults, reality paints a more unsettling picture: cyberattacks are rampant, accountability is rare, and the scales of justice tip unevenly against individual physicians, not corporate giants.
Welcome to the modern era of healthcare data privacy, where America’s medical secrets are no longer secret.
The Breach Heard Around the World
It started quietly. In early 2024, a ransomware attack targeted Change Healthcare, a subsidiary of UnitedHealth Group (that was in the late process of acquisition in 2023. Initially reported as a major cyberattack, the full extent only came to light later: over 191 million Americans had their private health data stolen. That’s more than half the country.
According to Change Healthcare, operations across pharmacy systems, claims processing, and revenue cycle management were disrupted. Oracle, whose cloud infrastructure supported part of the system, issued a warning to its health customers to act fast and secure their systems as a result of the breach’s severity.
What followed was surreal: a multi-million-dollar ransom paid to hackers, followed by a hilarious and sardonic infighting among cybercriminals arguing about who kept the money. Meanwhile, the healthcare giant moved on, issuing routine advisories to physicians about billing and coding, ironically from the same breached platform.
Despite this historic violation of HIPAA regulations, no one at Change Healthcare or UnitedHealth has been charged. No civil suit, no criminal indictment. Just a shrug and a press release.
Healthcare is full of fine print, power plays, and rules physicians are expected to navigate without a map. This expert-led SoMeDocs resource covers contract review, PBMs, healthcare law, patient-physician relationships, and the issues shaping medical practice today.
The Unequal Hammer of Justice
Contrast that with the story of Dr. Eithan Haim, a Texas surgery resident who was indicted under HIPAA laws for leaking non-identifiable patient data to expose that Texas Children’s Hospital was still performing gender-transition surgeries despite publicly stating otherwise. No names, no Social Security numbers—yet he faced criminal charges for his whistleblowing.
Dr. Haim’s actions helped spark public outrage and ultimately led to Texas banning gender-affirming care for minors. But his prosecution sent a chilling message: while health executives are rarely held accountable, physicians face the full force of the law—even when acting in the public’s interest.
The Department of Justice only dropped the charges in January 2025, following an executive order from President Donald Trump aimed at curbing what he called “the weaponization of the justice system”.
HIPAA’s Double Standard
HIPAA was enacted in 1996 to protect patient privacy while enabling efficient data flow in healthcare. But somewhere along the way, it became a blunt instrument wielded inconsistently.
Take Dr. Huping Zhou, who in 2010 served four months in jail for snooping into celebrity medical records without a need-to-know basis. Or Dr. Rita Luthra, a Massachusetts gynecologist convicted in 2018 for allowing a pharma rep to help with prior authorizations without a formal data agreement. She lost her medical license.
Were these HIPAA violations? Technically, yes.
But while individual physicians face prosecution for even marginal missteps, massive breaches exposing millions of patients’ full medical records, birthdates, and Social Security numbers, like those at Anthem, Premera Blue Cross, or Change Healthcare, end with a PR statement and business as usual. Over the last month Oracle the parent organization of Cerner announced a massive breach the may expose the health data of another 100 million people, that certainly rounds up the population of the United States. The health data of all 350 millions is out there (unless you go to an old fashioned doctor with paper medical records)
Some of the best healthcare voices are hiding in plain sight. Our speaker directory helps you find them, follow them, and invite them into the conversations that need them.
HIPAA: Toothless Against Corporate Negligence
HIPAA’s rules remain theoretically strong, but in practice, enforcement has become toothless—especially when dealing with corporate violators. The problem isn’t the law itself; it’s how it’s applied.
The Department of Health and Human Services (HHS) maintains a “Wall of Shame” listing data breaches affecting more than 500 people. But even when breaches are acknowledged, there’s rarely financial penalty, and almost never criminal liability. According to HIPAA Journal, breach notifications have become a routine part of healthcare, met with resignation, not reform.
Healthcare organizations chalk up cyberattacks to unavoidable risk, citing the scale and complexity of their systems. Yet as breaches grow in size and frequency, many experts argue that poor cybersecurity hygiene, not inevitability, is to blame. And still—no CEOs, CIOs, or board members have been brought to justice.
HIPAA was enacted in 1996 to protect patient privacy while enabling efficient data flow in healthcare. But somewhere along the way, it became a blunt instrument wielded inconsistently.
Is Your Health Data Already on the Dark Web?
Chances are, yes.
Experts estimate that nearly 85% of American adults’ protected health information (PHI) is already circulating on the dark web. That includes diagnoses, treatment records, insurance data, and even sensitive mental health histories. Unlike a credit card, you can’t cancel your medical history. Once it’s out, it’s out forever. All of it; the marital infidelity the STD’s, the cancer diagnosis, the genital herpes all out there for the world to see and muse about.
These breaches don’t just jeopardize your privacy; they endanger your financial security and personal safety. Cybercriminals can use PHI for identity theft, insurance fraud, and even blackmail. Breaches cause embarrassment to Healthcare Systems, as a local Health System in my area fought patients claiming no fault after the leak of nude patients’ photos taken for cancer staging into the web after the health system refused to pay a ransom. The Health System ultimately settled in a massive pay out to patients that caused it to merge with another larger Health System.
Yet public outrage remains muted. Perhaps it’s breach fatigue. Or maybe the medical jargon and technical complexity of HIPAA regulations keep people from grasping the scale of the threat.
Healthcare has a new watchlist. Explore SoMeDocs series you can watch or listen to anytime, including The Six, Conversations with Shem, Doctors on Walks Getting Food, and more.
HIPAA in a New Era: Reform or Relic?
It’s clear that HIPAA, as it stands, isn’t keeping up with the digital age.
The law was crafted in 1996 in an early internet age, pre-smartphone, pre-cloud, pre-ransomware world. Back then, “healthcare privacy” meant locking up paper files. Today, it means securing vast networks of interconnected databases, APIs, and third-party vendors, all vulnerable to attack. Unfortunately, much of our healthcare data is out there with Igor the hacker in Estonia who knows our most intimate healthcare secrets.
What HIPAA lacks is modern enforcement: targeted regulation of tech infrastructure, mandatory encryption standards, real-time breach detection, and equal accountability for corporations and individuals alike.
And let’s not forget the need for transparency. Victims of breaches often learn of them months (or even years after the fact), through vague, lawyer-approved letters. There’s little public recourse, few consequences, and even fewer answers.
Bring the idea. We’ll help build the show. From planning and production to polish and launch, we turn expertise into content that looks professional, feels intentional, & gives your audience a reason to return.
The Way Forward: Accountability for All
HIPAA unplugged means more than just a catchy headline. It reflects a growing reality: that the act once designed to safeguard privacy is now being gamed by powerful entities and weaponized against those without it.
To restore trust, there must be equal application of justice. When corporations expose millions of patients to identity theft and blackmail, executives should face real penalties, not just reputational slap on the wrist. And when physicians are prosecuted, it should be for genuine malfeasance, not technicalities or whistleblowing.
Until then, America’s medical secrets will remain not-so-secret. And the next time your doctor mails you a brochure about HIPAA privacy, remember: it’s not your physician who’s most likely to lose your data, it’s the system itself.
Author’s Note to Patients: If you’ve ever visited a hospital, filled out an insurance form, or received a prescription, your PHI is probably out there. You deserve to know who’s responsible—and to demand better. HIPAA needs more than an update. It needs a wake-up call.
Unlike a credit card, you can’t cancel your medical history. Once it’s out, it’s out forever.
