A 21-Hospital System Has Been Offline Since October 22 (11/04/2026)

Eleven days after its incident began, University Hospitals still could not tell patients when its digital systems would be back. Its hospitals and emergency departments are open, but pre-authorizations are disrupted and some appointments and elective procedures have been moved. For anybody who owns a business continuity plan, the useful number is eleven days and counting, because that is longer than many downtime procedures were written to last.

Top 5 Critical Compliance Alerts

1. University Hospitals Remains Offline After an October 22 Incident

University Hospitals, the Cleveland health system that operates 21 hospitals, identified a cybersecurity incident on October 22 and took digital services offline, including its MyChart patient portal, and as of a November 2 update said “a timeline for the restoration of normal business operations cannot be provided,” per the HIPAA Journal. Hospitals and emergency departments remain open, pre-authorizations have been disrupted, and the nature of the attack and the extent of any data involved have not been disclosed.

Operator Note: Pull out your downtime procedures and check how long they were written to cover. Paper processes designed for a weekend outage break in different ways at two weeks, especially for billing, authorizations, and anything that depends on a vendor portal.

2. A Late Self-Disclosure Cost Extreme Networks Its Declination

Extreme Networks resolved export control and sanctions violations by its former Russian subsidiary, which sold equipment from 2018 to 2022 to a weapons maker owned by a sanctioned entity, through a three-year non-prosecution agreement with the DOJ National Security Division, paying about $975,722 to DOJ and $1,529,685 to OFAC, per JD Supra. DOJ found the disclosure untimely because it came after a journalist contacted the company, and denied the declination it might otherwise have earned, while still crediting its investigation and remediation.

Operator Note: The value of a self-disclosure falls sharply the moment anybody outside the company knows. Your escalation path for a suspected export or sanctions violation should reach the people who can authorize a disclosure within days, and it should not wait for the internal investigation to finish.

3. HCA Healthcare Discloses a Breach of Patient and Resident Data

HCA Healthcare said an August 12 intrusion exposed data on patients of certain affiliated facilities and physician offices, including Social Security numbers and medical and insurance information, and HR files on medical residents that included immigration information, per the HIPAA Journal. HCA has not given a total, and 15,096 Texas residents are known to be affected.

4. The SFO Opens a Self-Reporting Channel and Proposes Whistleblower Rewards

The UK Serious Fraud Office now lets companies discuss a potential self-report informally with its director of legal services before formally reporting, and proposed a whistleblower reward scheme paying a percentage of the resulting penalty for information that is “significant and original,” open to people such as contractors and non-executive directors, per JD Supra. The consultation is expected to close January 8, 2027.

Operator Note: A reward scheme gives anybody who knows about a problem a reason to report it outside the company. The best response is an internal channel that people trust enough to use first.

5. Sentencing Guideline Amendments Raise Loss Thresholds

Amendments to the Federal Sentencing Guidelines that took effect November 1 raise the loss threshold for a 16-level enhancement from $1.5 million to $2 million and for a 20-level enhancement from $9.5 million to $15 million, with matching changes to the tax loss table and the organizational fine tables, primarily to account for inflation, per JD Supra.

Additional Compliance Alerts

Regulatory Updates

• The SEC updates its small entity definitions for investment companies and advisers: The amendments change which firms the SEC treats as small entities when it writes rules. SEC
• Colorado’s draft AI regulations preview new employer duties: The draft rules show how the state’s AI law will apply to employment decisions. JD Supra
• NERC asks FERC to fast-track data center registration rules: NERC wants faster action on rules for registering large data centers with the grid reliability regime. JD Supra

Healthcare

• Covenant Health settles its breach lawsuit for $2 million: The settlement resolves class action claims over the organization’s data breach. HIPAA Journal

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.