From ClingantryAI Health Regulator News

Business Associate MCBS, LLC filed a breach report with HHS OCR for a hacking/IT incident. The filing, submitted on June 26, 2026, indicates that the data of 1,261,464 individuals was involved. The breach occurred on a network server. As a Business Associate, MCBS must notify the covered entities it serves. Healthcare organizations that contract with MCBS should verify if they are among the impacted entities and prepare for potential patient inquiries. This filing reflects the date the report was submitted to regulators, not necessarily when the incident occurred or was discovered.

QualDerm Partners, LLC, classified in the HHS OCR record as a Healthcare Provider, reported a hacking/IT incident affecting 2,951,318 individuals. The record lists February 22, 2026 as the date the breach was submitted to HHS OCR. While secondary sources suggest this date may align with notification letters, the primary regulatory filing labels it as the submission date. The breach involved a network server. Healthcare administrators should note this incident involves a large provider entity. Because the entity is listed as a Healthcare Provider rather than a Business Associate, its regulatory obligations differ. Review your own incident response plans to ensure clear communication channels for both regulatory reporting and individual notifications.

Fieldtex Products, Inc., a Business Associate, filed an HHS OCR breach report on December 12, 2025, citing 104,071 individuals affected by a hacking/IT incident on a network server. This entry reflects the single OCR filing cited below; additional related filings have been reported elsewhere but are not covered by this record. If your organization uses Fieldtex services, review your contracts to understand notification obligations and monitor the OCR portal for further filings.

Dialysis provider DaVita Inc. filed a breach report with HHS OCR on August 1, 2025. The filing discloses a hacking/IT incident involving unauthorized access to a network server. The record lists 2,689,826 individuals affected. The state listed is Colorado, which is DaVita’s registration state; the record does not specify the server’s physical location. This submission date is when the report was sent to the government, not when the incident occurred. Healthcare administrators should note this is a 2025 filing. As a covered entity, DaVita’s obligations differ from those of business associates. Monitor for updates on specific data types exposed.