Editing Herzing Issues: Technology, LMS, and Platforms (section)

=== HU-120c: HIPAA risk if MSN-DE clinical discussion messages containing patient information were among the exposed Canvas messages ===
{| class="wikitable" style="width:100%"
! style="width:12em" | Severity
| High
! style="width:12em" | Status
| POSSIBLE, conditional on clinical messages containing patient information being among the exposed data
|-
! Issue type
| Potential HIPAA Breach Exposure
! Date added
| 2026-05-07 (split 2026-06-06)
|-
! Owner
| colspan="3" | Herzing Administration / Compliance / Clinical Coordination
|}
'''Finding.''' According to the tracker, if MSN-DE clinical discussion posts or messages contained patient information and were among the exposed Canvas messages, the breach could trigger obligations under the HIPAA Breach Notification Rule. Whether such content was exposed is not yet established and requires verification.

'''Evidence.''' Instructure's confirmation that messages among users were exposed; the program's clinical components, in which students discuss patient scenarios, raise the possibility that some messages contained patient information. Whether any such message was in the exposed set is unverified. Source group: Instructure incident reporting; program clinical structure.

'''Reported statement.''' <blockquote>indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users.</blockquote>

'''Standards.''' HIPAA Breach Notification Rule (45 C.F.R. 164.400-414): notification obligations may arise if protected health information was breached. Lead: {{HU|HU-120}}.

'''Impact.''' If patient information was exposed, affected individuals and authorities may need to be notified, and the institution and its clinical partners could face additional obligations and liability.

'''Notes.''' Sub-issue of {{HU|HU-120}} (lead). Split 2026-06-06. Marked POSSIBLE pending verification of whether clinical messages containing patient information were among the exposed data.

<span id="HU-122"></span>