From ClingantryAI Health Regulator News

Midwest Spine & Brain Institute, a healthcare provider in Minnesota, submitted a breach report to HHS OCR on August 14, 2026. The filing states that 108,487 individuals were affected by unauthorized access or disclosure of protected health information. The compromised data was located on a network server and other systems. This date reflects when the report was filed with the regulator, not when the incident occurred or was discovered. While secondary sources suggest the incident involved a vendor, 3C Care Systems, the official government record does not specify the cause or origin of the breach. Healthcare administrators should review this filing as an example of large-scale unauthorized access reporting.

Business Associate MCBS, LLC filed a breach report with HHS OCR for a hacking/IT incident. The filing, submitted on June 26, 2026, indicates that the data of 1,261,464 individuals was involved. The breach occurred on a network server. As a Business Associate, MCBS must notify the covered entities it serves. Healthcare organizations that contract with MCBS should verify if they are among the impacted entities and prepare for potential patient inquiries. This filing reflects the date the report was submitted to regulators, not necessarily when the incident occurred or was discovered.

Nacogdoches Memorial Hospital, a healthcare provider in Texas, filed a breach report with HHS OCR on March 30, 2026, regarding a hacking/IT incident. The OCR portal lists 2,507,073 individuals affected. While some secondary sources cite a lower figure of 257,073, the federal record stands at 2.5 million with no documented correction. The breach involved data stored on a network server. As a covered entity, the hospital is responsible for notifying affected individuals. Healthcare administrators should monitor official notifications from the hospital to understand the specific scope of exposure for their own patients or partners, as the federal filing does not detail the specific types of data compromised.

The Minnesota Department of Human Services, a state health plan, filed a breach report with HHS OCR on January 16, 2026. The filing covers 303,965 individuals and cites unauthorized access or disclosure of data stored on a network server. Healthcare administrators should note that this is a reportable breach involving a large number of people. The record does not specify whether the access was external or internal, only that it was unauthorized. Monitor for further updates from the agency regarding remediation steps or additional notifications.

Fieldtex Products, Inc., a Business Associate, filed an HHS OCR breach report on December 12, 2025, citing 104,071 individuals affected by a hacking/IT incident on a network server. This entry reflects the single OCR filing cited below; additional related filings have been reported elsewhere but are not covered by this record. If your organization uses Fieldtex services, review your contracts to understand notification obligations and monitor the OCR portal for further filings.

Veradigm LLC, a healthcare IT vendor classified as a Business Associate, reported a hacking/IT incident affecting 2,672,036 individuals. The HHS OCR record lists the submission date as September 22, 2025. Because Veradigm is a Business Associate, your organization’s obligations depend on your specific Business Associate Agreement and whether your patients’ data was involved. Review your contracts to understand liability and support responsibilities. Do not assume automatic notification duties; verify if your facility uses Veradigm services. Note that the related class action Goodrum v. Veradigm, Inc. has reached a final settlement. Payments for approved claims were issued on June 12, 2026, and uncashed checks void after September 10, 2026. Crucially, the OCR filing names Veradigm LLC, while the lawsuit names Veradigm, Inc.. These are distinct legal entities. Check your contracts for the exact legal entity name to ensure proper compliance.

Dialysis provider DaVita Inc. filed a breach report with HHS OCR on August 1, 2025. The filing discloses a hacking/IT incident involving unauthorized access to a network server. The record lists 2,689,826 individuals affected. The state listed is Colorado, which is DaVita’s registration state; the record does not specify the server’s physical location. This submission date is when the report was sent to the government, not when the incident occurred. Healthcare administrators should note this is a 2025 filing. As a covered entity, DaVita’s obligations differ from those of business associates. Monitor for updates on specific data types exposed.

Radiology Associates of Richmond, Inc., a Virginia-based healthcare provider, filed a breach notification with HHS OCR on July 1, 2025, reporting a hacking/IT incident affecting 1,419,091 individuals. The data was accessed from a network server. This entity has since disclosed a second, separate breach involving 266,183 individuals, stemming from an incident on or about July 25, 2025. This subsequent disclosure was reported to the Maine Attorney General on May 21, 2026. However, claims that this second breach has appeared on HHS OCR's public breach portal are unsupported by primary sources and contradicted by contemporaneous reporting stating it had not yet appeared. The HHS OCR record for the initial filing indicates no business associate was involved. Administrators should monitor the OCR portal for updates on both incidents.

Centers for Medicare & Medicaid Services (CMS) filed a report with HHS OCR on June 30, 2025, disclosing a hacking/IT incident that compromised the data of 107,154 individuals. The breach occurred on a network server. CMS is classified as a Health Plan under HIPAA. Healthcare administrators should note the scale of this federal breach as a benchmark for potential risks to their own systems.

Healthcare administrators using Episource, LLC for medical coding or risk-adjustment services should review their contracts and security protocols immediately. This Business Associate reported a hacking/IT incident to HHS OCR on June 6, 2025. The breach exposed the protected health information of 6,725,572 individuals stored on a network server. Because Episource acts as a vendor rather than a direct provider, your organization’s liability depends on your specific business associate agreement. Verify if your entity’s data was included in this massive exposure and confirm that Episource is providing required breach notifications to your patients if necessary.

A filing for Absolute Dental Group, LLC in Nevada lists the entity as a Business Associate. The HHS OCR record, submitted on May 2, 2025, reports 1,223,635 individuals affected by a hacking/IT incident on a network server. A $3.3 million class action settlement received preliminary court approval on March 6, 2026. The Final Approval Hearing is set for Thursday, July 30, 2026, per the official settlement administrator site. (The court docket entry, Doc. 92, reads "Thursday, July 31" — July 31 is a Friday, and every other source gives July 30, so the docket appears to contain a clerical error.) If your organization contracts with this dental group, confirm the date with the settlement administrator.

Ascension Health, a healthcare provider, filed a breach report with HHS OCR on April 28, 2025. The filing describes a hacking/IT incident that compromised the protected health information of 437,329 individuals. The unauthorized access occurred on a network server. While the record lists the entity's state as Missouri, it does not limit the breach to Missouri operations. The submission date marks when the report was sent to regulators, not when the breach occurred. Healthcare administrators should monitor for further details regarding specific data elements exposed and notifications to affected patients.

If your organisation uses Ciox Health LLC (doing business as Datavant Group) for data services, you may be affected by a significant security incident. This Business Associate reported a hacking/IT incident to HHS OCR on 10/07/2024. The filing lists 320,702 individuals affected. Protected health information was exposed via email. Because Datavant is a Business Associate, your own compliance obligations depend on your specific contract and data flow. Verify if you share data with this entity and review your Business Associate Agreement for notification requirements.