A Cyberattack Shutters 80 AnMed Facilities & a Revenue-Cycle Vendor Breaches 1.26M (07/27/2026)

Today’s compliance news is dominated by healthcare operations under strain, with one system forced to close most of its footprint and a vendor exposing more than a million people. The pattern for an operator is that a cyber incident is now a business-continuity event and a third-party-risk event at once, and the obligations do not pause while the systems are down.

Top 5 Critical Compliance Alerts

1. A Cyberattack Forces AnMed to Close Almost 80 Facilities

AnMed, a nonprofit health system serving upstate South Carolina and northeast Georgia, was forced to close almost 80 facilities while it grapples with a cyberattack (HIPAA Journal). Closing most of a system’s footprint is the clearest sign yet that a cyber incident is an operational-continuity crisis, not just a data problem, and every day of downtime is care delayed and revenue lost while the obligations to patients continue.

Operator Note: Your incident response plan needs an operational-continuity arm, not just a data-breach arm. Know in advance which facilities and services can run degraded, how you deliver care on paper, and how fast you can prove a system is clean enough to turn back on.

2. A Revenue-Cycle Vendor Breaches 1.26 Million People

MCBS, an Augusta, Georgia-based healthcare management and revenue-cycle company, disclosed a cybersecurity incident affecting 1.26 million individuals (HIPAA Journal). Revenue-cycle firms hold billing and patient data for the providers they serve, which makes one of them a single point of exposure for every practice that routed claims through it, and the breach notifications land on those providers’ names.

Operator Note: Map which of your vendors touch patient or billing data and confirm their breach-notification obligations to you in writing. A revenue-cycle partner’s incident becomes your patients’ exposure and your disclosure.

3. The DoD Implements the FY25 NDAA Contractor Prohibition

The Department of Defense issued regulations implementing an FY25 NDAA provision that prohibits awarding defense contracts to companies tied to certain covered lobbyists (JD Supra). Rules like this quietly reshape who is eligible to win or keep defense work, and a contractor needs to know whether its own relationships put an award at risk before a bid, not after.

4. ICE Raises the Cost of I-9 Mistakes

ICE reclassified Form I-9 violations in a way that raises the cost of errors that employers once treated as correctable technical mistakes (JD Supra). The long-relied-on distinction between a technical error and a substantive violation is narrowing, and employers who treated I-9 paperwork as low-risk should revisit their process before an audit prices the difference for them.

5. GAO Flags Duplicative Cyber Reporting for Critical Infrastructure

A GAO report identified potentially duplicative cyber-incident reporting requirements for critical infrastructure, ahead of CISA’s final rule implementing the incident-reporting mandate (HIPAA Journal). Overlapping reporting obligations pull time and staff away from the response itself, and organizations in scope should map which regimes they answer to now so a single incident does not become several uncoordinated filings.

Additional Compliance Alerts

Healthcare Breaches

• Four More Hospitals and Surgery Centers Report Breaches: Wildwood Surgical Center, Michigan Surgical Center, Penobscot Valley Hospital, and Whitfield Regional Hospital each disclosed data breaches. HIPAA Journal

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.