UMMC May Have Missed HIPAA Notification Deadline After Ransomware Attack
Summary
A public-records search found no documents showing UMMC notified patients or regulators after a February ransomware attack. UMMC says forensic analysis is ongoing; Medusa claims it took patient data, which UMMC has not confirmed.
Key points
- The February ransomware attack disrupted UMMC systems for nine days.
- WLBT’s public-records request found no documents showing UMMC reported the breach or notified patients.
- UMMC says it is working with the FBI and cybersecurity experts to determine what data was accessed or exfiltrated.
- UMMC said it would meet reporting requirements after its investigation; the article says the 60-day notification deadline had passed.
- Medusa claimed responsibility and said it obtained patient data, but UMMC has not confirmed the claim.
- A healthcare law attorney said regulators consider the circumstances when assessing whether a hospital violated privacy requirements.
Article Details
- Victim Organization
- University of Mississippi Medical Center (UMMC)
- Incident Type
- Ransomware attack
- Incident Date
- 2026-02-19
- Disclosure Date
- 2026-05-22
- Data Types Exposed
- Patient data (Medusa claimed it obtained patient data; UMMC has not confirmed access or theft)
- Operational Impact
- The attack disrupted or crippled hospital systems for nine days.
- Ransom Or Extortion
- No ransom demand or extortion activity is reported. Medusa claimed responsibility and alleged it obtained patient data; UMMC has not confirmed this.
- Claim Status
- claimed
People
Brant RyanHealthcare law attorney who commented on factors the government may consider when assessing whether a hospital violated privacy laws.Patrice GuilfoyleUMMC spokesperson who said on April 27 that the center was conducting forensic analysis to determine what data was accessed or exfiltrated and would meet reporting requirements after the investigation.