Good morning everyone,

This week brings a focused mix of privacy guidance and security priorities. OCR clarified how state Medicaid agencies may use certain substance use disorder records to verify community engagement exclusions. Newly reported website-tracking settlements also offer a practical reason to review what patient-facing websites send to outside companies.

On the security side, active exploitation affecting Cisco and Fortinet products deserves prompt attention. A newly published healthcare breach report provides additional context for reviewing vendor oversight and incident readiness. Below are five developments announced or newly reported September 29–October 5, with practical steps for compliance, privacy, security, and vendor-management teams.

Regulatory & Legal Updates

OCR clarifies Part 2 consent requirements for Medicaid exclusions (September 29, 2026)

What happened: HHS OCR issued guidance on using records protected by 42 CFR Part 2 to verify exclusions from Medicaid community engagement requirements. A state Medicaid agency may use records consistent with a previously obtained consent covering future treatment, payment, and healthcare operations, without obtaining another consent. Alternatively, it may obtain an appropriate written consent for the use. Restrictions on using records in proceedings against patients remain applicable. (HHS announcement; OCR guidance PDF)

Why it matters: For Medicaid agencies and their partners, the operational question is whether the consent accompanying a record supports the proposed eligibility use. Treat this as a targeted clarification; it does not provide unrestricted permission to reuse substance use disorder information.

Recommended actions:

• Map the Part 2 records used in eligibility workflows, including their source, consent scope, and who can access them.
• Have privacy and legal teams verify the applicable consent pathway before approving automated exclusion checks; retain the consent or accompanying explanation.
• Update staff instructions with examples of permitted eligibility uses and an escalation process for missing, unclear, expired, or revoked consent.

Fairchild and Boone Health pixel settlements highlight website privacy exposure (Reported October 2, 2026)

What happened: HIPAA Journal reported settlements involving Fairchild Medical Center and Boone Health/CH Allied Services over alleged disclosures through website-tracking tools. Fairchild’s approximately 1,000-member class may claim $25 and privacy-monitoring benefits; its final approval hearing is scheduled for October 15. Eligible Boone Health patients may claim $20 and receive privacy-monitoring benefits; its hearing is scheduled for December 1. Defendants deny wrongdoing. These are private litigation settlements awaiting final approval, not OCR enforcement penalties. (HIPAA Journal)

Why it matters: The allegations reinforce the value of reviewing website technology jointly across privacy, legal, marketing, and IT. A tool’s marketing purpose should not substitute for understanding the patient information it actually transmits.

Recommended actions:

• Test appointment, registration, and portal workflows for outbound data, including page URLs, form fields, identifiers, and analytics events.
• Reconcile observed trackers with approved vendors and contracts; suspend unreviewed data transfers pending assessment.
• Require privacy approval before tag-manager changes go live, and retain testing results and the rationale for each approved use.

Breach Trends & Vendor Risk

New first-half breach report reinforces the need to examine vendor involvement (September 30, 2026)

What happened: HIPAA Journal published its H1 2026 analysis of large breaches reported to OCR. It counted 397 reports involving approximately 33.77 million affected individuals, a 5.9% decline in reports compared with H1 2025. The analysis used OCR data obtained September 10 and cautioned that additional large incidents had yet to appear. It also explained that covered entities sometimes report vendor-originated breaches, making vendor involvement less visible in raw reporting categories. The new development is the report’s publication. (HIPAA Journal)

Why it matters: These figures offer context, not evidence that any individual organization’s risk has decreased. For internal reporting, distinguish the entity submitting a notice from the organization where the incident originated.

Recommended actions:

• Review your five vendors holding the most sensitive or extensive patient datasets; confirm retained data, subcontractors, and incident contacts.
• Track incident origin separately from notification responsibility in your breach register.
• Run a vendor-breach exercise covering incomplete patient lists, changing exposure estimates, notification ownership, and evidence needed for privacy and legal decisions.

Cybersecurity & Threat Intelligence

Cisco confirms exploitation of SD-WAN Manager authentication bypass (September 30; updated October 2, 2026)

What happened: Cisco disclosed CVE-2026-76504, a critical vulnerability that can let an unauthenticated remote attacker obtain administrative API access to Catalyst SD-WAN Manager. Cisco confirmed active exploitation and released fixes. Its October 2 update added a Live Protect shield, but described that shield as temporary, partial protection; upgrading remains necessary. (Cisco advisory)

Why it matters: For healthcare organizations using this platform, compromise of network-management infrastructure could threaten connectivity supporting clinical operations. Remediation should address both the vulnerable software and whether unauthorized access already occurred.

Recommended actions:

• Inventory internal and provider-managed deployments, record their versions, and verify upgrades against Cisco’s fixed-release table.
• Preserve and review the service-proxy and vManage server logs using Cisco’s indicators; investigate unfamiliar source addresses and suspicious authentication requests.
• Restrict management access to trusted hosts. Ask managed-service providers for deployment-specific remediation and investigation evidence, with unresolved exceptions assigned an owner and deadline.

Email Security & Vendor Oversight

FortiMail exploitation alert calls for immediate exposure review (October 1, 2026)

What happened: The Canadian Centre for Cyber Security issued an alert for Fortinet FortiMail vulnerability CVE-2026-104286, stating that Fortinet had reported exploitation in the wild and that CISA added it to the Known Exploited Vulnerabilities catalog on October 1. The alert identifies affected releases in the 8.0, 7.6, 7.4, and 7.2 branches and directs administrators to vendor guidance for remediation. (Canadian Centre for Cyber Security)

Why it matters: Include email-security appliances in your urgent vulnerability review, including those operated by outside providers. For compliance teams, the useful evidence is a verified deployment status and response record.

Recommended actions:

• Ask the email-service owner whether FortiMail is deployed, who manages it, and which software branch and version are running.
• Compare each deployment with Fortinet’s current advisory and confirm available fixes or required mitigations; retain evidence of implementation and validation.
• Where exposure or suspicious activity is identified, engage incident response, preserve relevant logs, and assess potential access to patient information with privacy and legal teams.

Closing Thoughts

Use this week’s developments to select a few concrete checks: trace one Part 2 record through its consent and eligibility workflow, inspect one patient-facing website journey, and verify the status of the affected network and email platforms. For each review, document the owner, evidence examined, unresolved questions, and next action.

For the coming week, connect findings to your risk analysis and remediation plan. Keep vendor notification responsibilities, workforce training, encryption coverage, access controls, monitoring, and recovery testing in that same review cycle. Defensible compliance is easier to demonstrate when teams can show how decisions were made and how safeguards were verified. Have a productive week.

‍