From ClingantryAI Health Regulator News

Dialysis provider DaVita Inc. filed a breach report with HHS OCR on August 1, 2025. The filing discloses a hacking/IT incident involving unauthorized access to a network server. The record lists 2,689,826 individuals affected. The state listed is Colorado, which is DaVita’s registration state; the record does not specify the server’s physical location. This submission date is when the report was sent to the government, not when the incident occurred. Healthcare administrators should note this is a 2025 filing. As a covered entity, DaVita’s obligations differ from those of business associates. Monitor for updates on specific data types exposed.

VectraRx Mail Pharmacy Services, LLC, a Healthcare Provider based in Arizona, reported a hacking/IT incident affecting 109,383 individuals. The breach involved data stored on a network server. The report was submitted to HHS OCR on February 6, 2025. This filing is relevant to healthcare administrators and vendors who interact with mail-order pharmacies or share data with similar entities. Because VectraRx is classified as a Covered Entity, this incident highlights risks for providers managing their own patient data systems. Administrators should review their own vendor management protocols to ensure partners maintain robust cybersecurity measures, particularly for systems handling large volumes of patient data. The primary source record does not confirm whether patient notifications have been sent or if credit monitoring was offered, nor does it indicate the incident is resolved.