Unimed Health Fund Fined 256,000 Shekels for Privacy Law Violation Under Amendment 13
Israel's Privacy Protection Authority has imposed a financial penalty of 256,000 shekels on Unimed Health Fund, marking the first fine issued under Amendment 13 to the Privacy Protection Law, which took effect in August 2025. The fine follows an administrative investigation triggered by a serious security incident reported by Unimed to the authority. The violation involved a delayed report of a significant data breach, where a widespread technical fault in Unimed's digital systems allowed some insured individuals to access sensitive medical information of their relatives under certain conditions.
The breach was uncovered after a patient reported being able to view the medical records of his stepsister. The fault was corrected by the end of January 2026. According to the authority, the compromised database contained highly sensitive personal health information protected under the Patient Rights Law. Unimed claimed that only a limited number of people accessed the data without authorization and that only the complainant actually viewed the information in the past two years.
The Privacy Protection Authority stated that Unimed was aware of the breach as early as November 2025 but only reported it two months later in January after conducting internal investigations. The authority emphasized that the obligation to report arises immediately upon discovering unauthorized access, without waiting for the completion of internal checks or determining the breach's scope. Immediate preliminary reporting is required, with supplementary details to follow.
Gilead Samama, head of the Privacy Protection Authority, highlighted that violations under Amendment 13 carry significant financial sanctions and urged organizations to rigorously assess their information systems to ensure optimal protection of sensitive Israeli citizens' data. Amendment 13 represents the most comprehensive update to Israel's privacy laws in decades, expanding enforcement powers, including heavy fines and criminal investigation authority, mandating appointment of Data Protection Officers in organizations handling extensive sensitive data, and broadening the definition of sensitive information while reducing technical regulatory burdens.
Unimed Health Fund did not provide a comment on the fine.
