Legal
Xsolis Breach Exposes 1.4 Million Patients Across Nine Health Systems
Healthcare AI vendor Xsolis disclosed a data breach affecting 1.4 million patients across at least nine health systems, including Mayo Clinic, UW Medicine, and Carle Health. Xsolis provides utilization management and care coordination technology used by hospitals, including those serving Medicaid managed care populations, to process authorization and clinical review data. The company reported that an unauthorized party accessed its IT environment on Jan. 20 via a phishing attack and acquired a limited number of files, with the incident reported to HHS on June 5. Xsolis says it has no evidence of data misuse and is notifying affected individuals; at least one lawsuit has been filed over the breach.
Why it mattersHealth systems and plans relying on Xsolis for utilization management must assess HIPAA breach notification obligations and vendor oversight exposure, including for Medicaid enrollees whose authorization data may have been compromised.