Maccabi Health Services Fined NIS 256,000 for Delayed Reporting of Medical Data Breach

Maccabi Health Services (Meuhedet) has been fined 256,000 shekels by Israel's Privacy Protection Authority for failing to immediately report a serious security breach involving sensitive medical information. The breach was discovered in November 2025 but was only reported to the authority in January 2026, violating the immediate reporting requirement under the Privacy Protection Law and its regulations. The incident involved a technological glitch in Meuhedet's digital system that allowed unauthorized access to personal medical records, including cases where insured individuals could view medical information of their step-relatives.

The Privacy Protection Authority initiated an administrative investigation after receiving a complaint from a member who found he could access his step-sister's medical file. Subsequent checks revealed the flaw was widespread and could expose sensitive health data of many insured members. The breach was fixed by the end of January 2026. Meuhedet claimed only a limited number of people accessed the data and only the complainant actually viewed it in the past two years.

The authority emphasized that the obligation to report such breaches arises as soon as the event is known, without waiting for full investigation or understanding of the breach's scope. It rejected arguments that reporting should be delayed until all details are confirmed, stating that initial reports should be based on available information and supplemented later if needed. The fine reflects the authority's first use of financial sanctions under Amendment 13 to the Privacy Protection Law, effective August 2025.

Privacy Authority head Gilad Samama highlighted the importance of protecting sensitive Israeli citizens' data and warned organizations to rigorously audit their information systems. Enforcement division head Adi Menachem Bar stressed that immediate reporting is mandatory upon awareness of a serious security event, especially for entities controlling large sensitive databases, and that the authority will not accept interpretations that undermine this requirement.