Israeli Privacy Authority Imposes Record Fine on Meuhedet Health Fund Under New Data Protection Law

Meuhedet Health Fund was fined 256,000 shekels this week by the Israeli Privacy Protection Authority for a significant delay in reporting a serious security breach. The breach, which occurred in November 2025, allowed insured individuals to access sensitive medical information of their relatives. The fund reported the incident only in January 2026, nearly two months late, violating the immediate reporting requirement under the recently enacted Amendment 13 to the Privacy Protection Law.

Amendment 13, effective since August 2025, represents the most comprehensive update to Israeli privacy law in decades. It significantly expands the authority's enforcement powers, including criminal tools and the ability to impose heavy fines reaching hundreds of thousands or even millions of shekels. The amendment also mandates appointing Data Protection Officers (DPOs) in organizations handling extensive sensitive data, such as hospitals and banks, while streamlining technical regulations.

The Meuhedet case marks the first enforcement action under Amendment 13 and signals a new era of aggressive regulatory oversight. Since the amendment's implementation, the authority has opened over 100 enforcement cases against major entities, with fines expected to range from hundreds of thousands to millions of shekels depending on the severity and scope of violations. Many organizations are still in the process of complying with the new regulations.

The Privacy Authority emphasizes that the obligation to report breaches arises immediately upon discovery, not after internal investigations conclude. Meuhedet criticized the immediate reporting requirement as unrealistic, stating it plans to appeal the fine. Legal experts note that the fine sends a clear message that organizations must be prepared in advance to manage privacy and security incidents promptly. They also highlight concerns about the lack of differentiation between types of breaches, which may overwhelm the authority with reports and obscure truly severe incidents.

Overall, the enforcement of Amendment 13 is prompting companies to align their privacy practices with the new legal standards, marking a significant shift in Israel's data protection landscape.