Samwise Healthcare IT Newsletter
Sunday, September 27, 2026
Wyden and Warner Reintroduce Legislation for Mandatory Healthcare Cybersecurity Standards and $1.3B in Funding
Senators Ron Wyden (D-OR) and Mark Warner (D-VA) reintroduced the Health Infrastructure Security and Accountability Act, bipartisan legislation that would direct the Department of Health and Human Services to establish mandatory minimum cybersecurity standards for hospitals and health plans, replacing the current voluntary framework. The bill also proposes appropriating $1.3 billion over five years to help smaller and rural health systems meet the new requirements. Sponsors argue that voluntary guidance has proven insufficient following a wave of ransomware attacks on healthcare facilities. The legislation would give HHS enforcement authority to penalize organizations that fail to meet the mandated standards.
Sources: GovInfoSecurity
House Veterans Affairs Committee Subpoenas Oracle’s Larry Ellison and CEO Mike Sicilia Over $27B EHR Failures
The House Veterans Affairs Committee voted 19-0 to subpoena Oracle Chairman Larry Ellison and Oracle Health CEO Mike Sicilia, demanding documents and testimony about persistent failures in the Department of Veterans Affairs’ $27 billion electronic health record modernization program. The VA’s Oracle-built EHR system has faced repeated go-live delays, patient safety events, and widespread clinical workflow complaints since deployment began. Committee members from both parties expressed frustration with Oracle’s pace of remediation. The unanimous vote signals rare bipartisan agreement that Oracle has not adequately addressed problems threatening care continuity for millions of veterans receiving care at VA facilities.
Sources: Healthcare Dive
DCM4CHE Medical Imaging Archive Flaws Could Let Attackers Inject Fabricated Patient Scans
Multiple security vulnerabilities in DCM4CHE, a widely used open-source medical imaging archive toolkit, could allow unauthenticated attackers to delete stored patient scans, inject fabricated studies into medical records, or reassign imaging data to incorrect patient identities, researchers warn. Researcher Abhinav Agarwal identified denial-of-service flaws — including infinite loop vulnerabilities in the software’s parsers — along with unauthenticated access issues affecting DICOM and HL7 interfaces. Several commercial picture archiving and communications systems integrate DCM4CHE components, including MedDream and Mesys. No evidence of active exploitation against healthcare organizations has been reported, and vendors are working on patches.
Sources: GovInfoSecurity
HHS Fines Ambry Genetics $700,000 Following HIPAA Breach Tied to Phishing Attack
The Department of Health and Human Services Office for Civil Rights imposed a $700,000 civil monetary penalty on Ambry Genetics, a cancer genetic testing laboratory, after a phishing attack exposed protected health information belonging to more than 230,000 patients. OCR investigators found that Ambry Genetics failed to conduct an adequate risk analysis and implement sufficient access controls prior to the breach. The settlement continues OCR’s enforcement emphasis on phishing vulnerabilities, which remain the leading initial access vector in healthcare data breaches. Ambry Genetics, which provides hereditary cancer testing services, has since been acquired by Laboratory Corporation of America.
Sources: GovInfoSecurity
Epic Systems Pauses New Feature Development to Focus Engineering Resources on Cybersecurity
Epic Systems announced it is halting new product feature development for at least two quarters, redirecting its engineering teams to concentrate on cybersecurity improvements across its EHR platform. CEO Judy Faulkner disclosed the pause at Modern Healthcare’s Leadership Summit, describing it as a proactive response to the evolving healthcare threat landscape. The effort involves hundreds of Epic employees and affects product updates at health system clients across the country. Epic said its development roadmap remains unchanged from its August UGM presentation. Analysts noted the pause signals the most significant shift in Epic’s product prioritization in years, with the company expected to issue a higher-than-usual volume of urgent security patches.
Sources: Modern Healthcare
Oracle Health Extends Ambient Clinical AI Agent to Nursing Workflows at Major Health Systems
Oracle Health announced the expansion of its ambient clinical intelligence AI agent beyond physician workflows to include nursing documentation at several major health systems. The AI system, which listens to patient-provider conversations and automatically generates structured clinical notes, is now being adapted to capture nursing assessments, care plans, and handoff communications. Nurses spend a significant portion of each shift on documentation, and Oracle Health executives said reducing that administrative burden is a primary goal of the expansion. The move follows Oracle’s broader AI push across its health cloud platform and comes as Epic, Nuance, and other EHR vendors have made ambient AI documentation central to their product strategies.
Sources: Healthcare Dive
Oracle Health Unveils Dedicated Oncology EHR at Annual Health and Life Sciences Summit
Oracle Health unveiled the Oracle Health Oncology EHR at its annual Health and Life Sciences Summit, positioning the product as a purpose-built clinical record system for cancer care programs. The platform integrates treatment planning, clinical trial eligibility matching, and multidisciplinary care team coordination within a single environment, drawing on Oracle’s broader cloud infrastructure and AI capabilities. Oracle executives framed the release as evidence of the company’s ability to deliver specialized clinical tools on top of its core EHR infrastructure. The launch comes as Oracle Health works to stabilize its broader EHR platform and address ongoing implementation challenges at the Department of Veterans Affairs.
Sources: Healthcare IT News
MEDITECH Expanse Goes Live Across First Full HCA Healthcare U.S. Divisions, Covering 34 Hospitals
MEDITECH Expanse completed go-live across HCA Healthcare’s Capital and North Florida divisions, making them the first two of HCA’s 15 U.S. divisions to fully implement the Expanse platform. The milestone brings 72 HCA hospitals in the United States and United Kingdom onto MEDITECH Expanse, with the Capital Division covering 18 hospitals in Virginia and New Hampshire and North Florida covering 16 hospitals. MEDITECH was also recognized as a Leader in the 2026 Gartner Magic Quadrant for Enterprise EHR during the same week. HCA Healthcare has additional divisions scheduled for Expanse go-lives in October, continuing one of the largest active EHR rollouts in the country.
Sources: Becker’s Hospital Review
Hello Patient Acquires Converse Health to Expand AI Agents Across Outpatient Administrative Workflows
Hello Patient, a platform that automates AI-driven patient communications, acquired Converse Health, an AI workflow automation company built for outpatient medical practices. The deal adds AI agents capable of handling documentation and chart work surrounding patient visits to Hello Patient’s existing front-office automation capabilities. Together, the companies aim to cover the full administrative arc of an outpatient encounter — from first patient call through post-visit follow-up — without manual staff intervention. Converse Health, founded in 2023 and serving specialties including dermatology, orthopedics, and women’s health, raised $1.3 million before the acquisition. Financial terms were not disclosed.
Sources: MobiHealthNews
KLAS 2026 Report: Epic Gains Global EHR Market Share as Oracle Health Loses Ground
A new global EHR market report from KLAS Research found that Epic Systems significantly expanded its international customer base in 2026, winning contracts across Europe, the Middle East, and Asia as health systems sought vendors with proven large-scale deployment records. Oracle Health, by contrast, saw market share decline in several regions as customers cited implementation challenges and delayed delivery timelines. The report identified EHR consolidation as a continuing global trend, with health systems favoring vendors capable of supporting interoperability at a national scale. Epic’s overseas expansion accelerates a trend that became visible in earlier European engagements, particularly in the Nordic countries.
Sources: Healthcare IT News
Every newsletter preserved and searchable
Curated by JD · samwise.agency