Court Locks Down the Change Healthcare Dataset in Litigation (08/12/2026)

The Change Healthcare litigation order is worth reading even if you have nothing to do with the case, because it is a court deciding how stolen health data gets handled once it becomes evidence. That question is going to recur, and the answer sets expectations for everyone holding a copy of a breach dataset for legal reasons.

Top 5 Critical Compliance Alerts

1. A Court Sets Handling Rules for Breached Health Data

The volume and sensitivity of data taken from Change Healthcare in the 2024 ransomware attack led a court to impose strict rules on how that dataset may be used in the multidistrict litigation. HIPAA Journal

Operator Note: Stolen data does not stop being protected health information when it becomes evidence. If your organization is holding a breach dataset for litigation, discovery, or forensics, that copy carries the same obligations as the original and usually sits outside the controls protecting production.

2. Critical Flaws in a Fertility Tracker and a Nerve Stimulator

Researchers identified vulnerabilities in the Mira Hormone Monitor, a widely used fertility tracking device, and the Pulsetto vagus nerve stimulator. HIPAA Journal

Operator Note: Fertility data is among the most consequential categories a person can generate, and consumer wellness devices sit outside most of the regulation people assume covers health information. If your benefits program promotes any of these, you are recommending a data relationship you have not assessed.

3. FINRA Declines to Write AI Rules

FINRA has opted not to issue new artificial intelligence rules, and practitioners are arguing the absence itself creates the compliance problem. JD Supra

Operator Note: No new rules means the existing ones apply in full, which is harder rather than easier. Supervision, books and records, and communications obligations were written before the tools existed and still bind, so the burden of showing an AI-assisted process meets them sits with you.

4. The FTC Wants Your Made in USA Substantiation

The FTC is pressing companies making American-origin claims to produce the files backing them up. Corporate Compliance Insights

Operator Note: Substantiation means a file assembled before the claim ran, not one reconstructed after the letter arrives. If marketing put the phrase on a package, somebody should be able to produce the supply chain documentation today.

5. Five More Small Healthcare Breaches

Five small healthcare organizations announced data breaches. HIPAA Journal

Operator Note: Small providers rarely make national coverage and carry the same notification obligations as a hospital system. The gap between what they owe and what they are resourced to do is where most of these end up.

Additional Compliance Alerts

Regulatory Updates

• The SEC’s proposed quarterly reporting change draws cost questions: Practitioners are weighing compliance cost against investor protection. Corporate Compliance Insights
• A mid-year round-up on EMEA privacy, digital regulation, and AI: Useful if you operate across European jurisdictions and have lost track of what changed. JD Supra

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.