From ClingantryAI Health Regulator News

A California Court of Appeal has ruled that out-of-network reimbursement rates are not exempt from state antitrust laws. The court reversed a lower court decision in a case brought by VHS Liquidating Trust, the bankruptcy liquidator for the former Verity Health System. VHS alleged that MultiPlan Corporation (now Claritev) engaged in price-fixing. The court describes MultiPlan as a company that “uses proprietary algorithms to suggest the reimbursement rates insurers and other third-party payors should pay” for out-of-network care. The appellate court held that payments for out-of-network services are prices under the Cartwright Act, meaning they can be subject to antitrust liability if fixed or tampered with. The ruling lets the case proceed; the price-fixing claims remain allegations.

Leggett & Platt, Incorporated Employee Benefit Plan, a health plan in Missouri, reported a hacking/IT incident involving its network server. The breach impacts 61,702 individuals. HHS OCR received the filing on 09/15/2026. This submission date is when the report was filed, not necessarily when the breach occurred or was discovered. Health plans must notify affected individuals and HHS for breaches involving unsecured protected health information. Administrators should verify if their vendors or partners are similarly exposed to network server vulnerabilities.

Healthcare administrators should note that Clover Health, a health plan operating in Minnesota, recently reported a significant data breach to HHS OCR. The incident, classified as a Hacking/IT Incident, affected 138,677 individuals. The breach involved information stored on a network server and other locations. This filing, submitted on September 14, 2026, highlights the ongoing cybersecurity risks faced by health plans and other healthcare entities. Organizations should review their own security protocols to protect patient data from similar threats.

The Department of Health Care Finance for the District of Columbia filed a breach report with HHS OCR on September 3, 2026. The filing covers 399,086 individuals whose protected health information was involved in an unauthorized access or disclosure. The compromised data resided in an electronic medical record system. As a health plan, this entity is a covered entity under HIPAA. This submission date reflects when the report was filed with the government, not necessarily when the incident occurred or was discovered. Healthcare administrators should note the scale of this event involving a major public health plan.

The Minnesota Department of Human Services, a state health plan, filed a breach report with HHS OCR on January 16, 2026. The filing covers 303,965 individuals and cites unauthorized access or disclosure of data stored on a network server. Healthcare administrators should note that this is a reportable breach involving a large number of people. The record does not specify whether the access was external or internal, only that it was unauthorized. Monitor for further updates from the agency regarding remediation steps or additional notifications.

Brightstar Global Solutions Corporation, a health plan based in Rhode Island, filed a report with HHS OCR on October 3, 2025, regarding a hacking/IT incident. The breach compromised the protected health information of 103,879 individuals. The unauthorized access occurred on a network server. As a covered entity, Brightstar is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor this case to understand how large-scale cyber incidents are handled by health plans. This filing confirms the breach was reported to regulators; it does not indicate when the incident originally occurred or was discovered.

Centers for Medicare & Medicaid Services (CMS) filed a report with HHS OCR on June 30, 2025, disclosing a hacking/IT incident that compromised the data of 107,154 individuals. The breach occurred on a network server. CMS is classified as a Health Plan under HIPAA. Healthcare administrators should note the scale of this federal breach as a benchmark for potential risks to their own systems.