OSF Healthcare Pays $552K to OCR & California Mandates AI Training-Data Disclosure (07/30/2026)

Today’s compliance news pairs a healthcare enforcement action with the arrival of real AI disclosure rules on two continents. The through-line is documentation: what you can show a regulator about how you handled protected data, what went into your model, and where a payment actually went. Each of these cases turns on records somebody either kept or did not.

Top 5 Critical Compliance Alerts

1. OSF Healthcare Pays $552,250 to Settle an OCR Investigation

OSF Healthcare System and its affiliated covered entities agreed to pay $552,250 to resolve a HIPAA investigation by the Office for Civil Rights (HIPAA Journal). OCR settlements in this range are the routine enforcement that rarely makes national news, and they are the better predictor of what your own organization faces than the rare eight-figure headline case.

Operator Note: Most OCR actions trace back to the same handful of gaps: a missing or stale risk analysis, access controls nobody reviewed, and audit logs that cannot answer who saw what. Those are the three things to have current before an investigator asks.

2. California Requires Disclosure of GenAI Training Data

California’s AB 2013, signed as part of a wave of AI legislation, imposes new disclosure requirements on developers of generative AI systems regarding the data used to train them (JD Supra). Training-data provenance has been the least documented part of the AI supply chain, and a disclosure mandate turns a question vendors have deflected into one they have to answer in writing.

3. The EU Finalizes AI Act Article 50 Transparency Guidelines

The European Commission published its final guidelines on transparency obligations under Article 50 of the EU AI Act on July 20, providing practical clarification ahead of the obligations taking effect (JD Supra). Article 50 reaches beyond high-risk systems, so organizations that concluded the AI Act did not apply to their use case should re-read the scope before the deadline decides it for them.

4. A Former CPA Is Sentenced Over a $5.3M Healthcare BEC

A former CPA was sentenced for laundering proceeds from a 2023 business email compromise against a vendor of Children’s Healthcare of Atlanta that resulted in $5.3 million in losses (HIPAA Journal). Business email compromise remains the highest-dollar fraud most organizations face, and it lands through a vendor’s invoice process rather than any technical control on your own network.

Operator Note: Verify every change to vendor payment details out of band, using a phone number you already had rather than one in the email requesting the change. That single procedure defeats most of the BEC losses in this category.

5. Executive Order 14398 Reaches Federal Grant Recipients

Executive Order 14398, signed March 26, requires new clauses in federal contracts and contract-like instruments and may impose penalties on employers that receive federal grants or work with federal contractors (JD Supra). Organizations that take federal money indirectly often do not track contract-clause changes, and this is the kind of requirement that arrives through a prime contractor’s flow-down long after the deadline to prepare.

Additional Compliance Alerts

Supply Chain

• EU Forced Labor Guidelines Arrive With Due-Diligence Expectations: The European Commission published guidelines on the EU Forced Labor Regulation, which bars products made with forced labor from the EU market and effectively sets due-diligence expectations for importers. JD Supra

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.