From ClingantryAI Health Regulator News

A California Court of Appeal has ruled that out-of-network reimbursement rates are not exempt from state antitrust laws. The court reversed a lower court decision in a case brought by VHS Liquidating Trust, the bankruptcy liquidator for the former Verity Health System. VHS alleged that MultiPlan Corporation (now Claritev) engaged in price-fixing. The court describes MultiPlan as a company that “uses proprietary algorithms to suggest the reimbursement rates insurers and other third-party payors should pay” for out-of-network care. The appellate court held that payments for out-of-network services are prices under the Cartwright Act, meaning they can be subject to antitrust liability if fixed or tampered with. The ruling lets the case proceed; the price-fixing claims remain allegations.

A New York healthcare provider, Premier Medical Group of the Hudson Valley P.C., filed a report with HHS OCR on August 21, 2026, disclosing a significant security incident. The filing indicates that a hacking/IT incident compromised data stored on a network server, affecting approximately 282,075 individuals. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred or was discovered. As a covered entity, the medical group is required to notify affected patients and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

Midwest Spine & Brain Institute, a healthcare provider in Minnesota, submitted a breach report to HHS OCR on August 14, 2026. The filing states that 108,487 individuals were affected by unauthorized access or disclosure of protected health information. The compromised data was located on a network server and other systems. This date reflects when the report was filed with the regulator, not when the incident occurred or was discovered. While secondary sources suggest the incident involved a vendor, 3C Care Systems, the official government record does not specify the cause or origin of the breach. Healthcare administrators should review this filing as an example of large-scale unauthorized access reporting.

Home health provider AdaptHealth, LLC filed a breach report with HHS OCR on August 14, 2026, disclosing that a hacking/IT incident compromised the protected health information of 4,115,802 individuals. The unauthorized access occurred on a network server. As a healthcare provider, AdaptHealth is a covered entity under HIPAA. This filing date represents when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data elements exposed and any potential impact on shared patient records.

A healthcare provider, Baylor Genetics, filed a report with HHS OCR on August 14, 2026, disclosing a hacking/IT incident that compromised the data of 2,810,878 individuals. The breach occurred on a network server. This filing date is when the report was submitted to the government, not necessarily when the incident occurred or was discovered. Healthcare administrators should note the scale of this incident involving a major genetics laboratory. While no specific remediation steps are detailed in the filing, the sheer volume of affected records highlights the ongoing risks associated with large-scale data storage. Monitor official HHS OCR updates for further details on this specific case.

A Massachusetts healthcare provider serving homeless populations has reported a significant security incident to HHS OCR. The Boston Healthcare for the Homeless Program filed a breach notice on August 10, 2026, disclosing that 201,260 individuals were affected. The incident is classified as a hacking/IT incident involving unauthorized access to a network server. As a covered entity, this provider is required to notify affected individuals and report the breach to the government. Healthcare administrators should review their own network security protocols, particularly for server infrastructure, to ensure robust defenses against similar unauthorized access attempts.

One Medical Group, Inc., a healthcare provider in California, filed a breach report with HHS OCR on July 17, 2026. The filing describes a hacking/IT incident that compromised the protected health information of 153,174 individuals. The breached data was located on a network server. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor their own vendor contracts and security protocols, as large-scale provider breaches often signal broader industry threats. While this specific incident involves One Medical Group, the scale highlights the ongoing risk of network server vulnerabilities in healthcare IT infrastructure.

A healthcare provider in Massachusetts has filed a report with HHS OCR regarding a hacking/IT incident. The entity, operating as Brown Health Medical Group-MA, states that the breach impacted 311,760 individuals. The unauthorized access occurred on a network server. This filing was submitted to the government on July 16, 2026. Healthcare administrators should note that this is a covered entity report, distinct from a business associate filing. While the specific data elements are not detailed here, the scale suggests significant patient data exposure. Monitor for further disclosures from the provider regarding notification timelines and remediation steps.

Madera Community Hospital, a healthcare provider in California, filed a breach report with HHS OCR on July 13, 2026. The filing describes a hacking/IT incident involving a network server. The breach potentially exposed the protected health information of 150,810 individuals. This submission date marks when the report was sent to regulators, not when the incident occurred. Healthcare administrators should note the scale of this exposure as a reminder of the risks associated with network server vulnerabilities. While this specific event affects a single provider, it highlights the ongoing threat of cyberattacks in the healthcare sector. Monitor your own systems for similar indicators of compromise.

Anatomic and Clinical Laboratory Associates, P.C., a healthcare provider in Tennessee, submitted a breach notification to HHS OCR on June 23, 2026. The filing reports a hacking/IT incident involving a network server that exposed the data of 169,626 individuals. This submission date marks when the report was filed with regulators, not necessarily when the breach occurred or was discovered. As a covered entity, the laboratory is required to report breaches affecting 500 or more individuals within 60 days of discovery. Healthcare administrators should monitor for further details regarding the specific types of protected health information compromised and any subsequent notifications to affected individuals.

Western Orthopaedics, P.C., a healthcare provider in Colorado, filed a breach notification with HHS OCR on May 1, 2026. The filing reports a hacking/IT incident that compromised the protected health information of 113,330 individuals. The unauthorized access occurred on the organization's network server. This submission date marks when the report was sent to the regulator, not necessarily when the breach occurred or was discovered. As a covered entity, Western Orthopaedics is required to report breaches affecting 500 or more individuals within 60 days of discovery. Healthcare administrators should monitor for similar IT incidents and ensure their own incident response plans are current.

A Florida-based healthcare provider named Florida Physician Specialists has filed a report with HHS OCR regarding a significant data breach. The incident, classified as a hacking/IT incident, compromised information stored on a network server. The filing indicates that 276,498 individuals were affected by this security failure. The report was submitted on April 24, 2026. Healthcare administrators should note the scale of this breach, which underscores the risks associated with network server vulnerabilities. While this specific event involves a provider group, the implications for data security practices are relevant to all entities handling protected health information. Monitor your own network defenses and review incident response protocols to ensure preparedness against similar threats.

A healthcare provider in South Carolina, Innovative Scientific Solutions, LLC, reported a hacking/IT incident to HHS OCR on April 17, 2026. The breach affected 143,842 individuals after unauthorized access to a network server. This filing date reflects when the report was submitted, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data compromised and any required notifications to affected patients or partners.

A healthcare provider in Illinois has reported a significant data breach to HHS OCR. Southern Illinois Dermatology filed a notice on April 2, 2026, stating that a hacking/IT incident compromised the personal information of 160,312 individuals. The unauthorized access occurred on a network server. This filing date represents when the report was submitted to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor their own systems for similar vulnerabilities and ensure their incident response plans are current, as large-scale provider breaches often signal broader industry threats.

Nacogdoches Memorial Hospital, a healthcare provider in Texas, filed a breach report with HHS OCR on March 30, 2026, regarding a hacking/IT incident. The OCR portal lists 2,507,073 individuals affected. While some secondary sources cite a lower figure of 257,073, the federal record stands at 2.5 million with no documented correction. The breach involved data stored on a network server. As a covered entity, the hospital is responsible for notifying affected individuals. Healthcare administrators should monitor official notifications from the hospital to understand the specific scope of exposure for their own patients or partners, as the federal filing does not detail the specific types of data compromised.

Erie Family Health Centers, a healthcare provider in Illinois, submitted a breach notification to HHS OCR on March 27, 2026. The filing reports a hacking/IT incident that compromised the protected health information of 570,000 individuals. The breach occurred on a network server. This submission date reflects when the report was filed with the regulator, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any required notifications to affected patients.

New York City Health and Hospitals Corporation filed a breach notification with HHS OCR on March 24, 2026, reporting that a hacking/IT incident exposed the protected health information of 1.8 million individuals. The unauthorized access occurred on a network server. As a healthcare provider and covered entity, the organization is required to report breaches affecting 500 or more individuals to HHS within 60 days of discovery. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any potential impact on shared systems or business associates.

Saint Anthony Hospital, a healthcare provider in Illinois, filed a breach notification with HHS OCR on March 6, 2026. The filing reports a hacking/IT incident that exposed the protected health information of 146,108 individuals. The compromised data was located in email systems. This submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should note the scale of this incident as a reminder of the risks associated with email-based communications and unauthorized access.

A healthcare provider, North Texas Behavioral Health Authority, filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on March 6, 2026, indicates that 285,086 individuals were affected. The breach occurred on a network server. As a covered entity, the authority is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

IPPC Inc., IPPC of New York LLC, and Innovative Pharmacy LLC (collectively IPPC) filed a breach report with HHS OCR on February 27, 2026. The New Jersey-based healthcare provider reported a hacking/IT incident involving its network server. The filing indicates that 133,862 individuals were affected by the unauthorized access. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor their own vendor relationships and security protocols, as large-scale provider breaches often signal broader industry threats.

QualDerm Partners, LLC, classified in the HHS OCR record as a Healthcare Provider, reported a hacking/IT incident affecting 2,951,318 individuals. The record lists February 22, 2026 as the date the breach was submitted to HHS OCR. While secondary sources suggest this date may align with notification letters, the primary regulatory filing labels it as the submission date. The breach involved a network server. Healthcare administrators should note this incident involves a large provider entity. Because the entity is listed as a Healthcare Provider rather than a Business Associate, its regulatory obligations differ. Review your own incident response plans to ensure clear communication channels for both regulatory reporting and individual notifications.

A Florida healthcare provider, Wound Technology Network, Inc., filed a breach report with HHS OCR on January 28, 2026. The filing details a hacking/IT incident that compromised the protected health information of 139,830 individuals. The unauthorized access occurred on a network server. As a covered entity, the provider is required to report breaches affecting 500 or more individuals within 60 days of discovery. This submission date reflects when the report was filed with the government, not necessarily when the breach occurred. Healthcare administrators should monitor such filings to understand the evolving threat landscape, particularly for providers managing sensitive wound care data. No further details on the specific nature of the data accessed or the timeline of the incident are provided in this summary.

A major hacking/IT incident at VITAS Hospice Services, LLC, a healthcare provider in Florida, has been reported to HHS OCR. The filing, submitted on November 24, 2025, indicates that the personal information of 319,177 individuals was compromised. The breach originated from a network server. As a covered entity, VITAS is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor for further details regarding the specific data types exposed, as this large-scale incident highlights the ongoing risks to provider networks.

A healthcare provider in Texas has reported a significant data breach to HHS OCR. The Denton MHMR Center filed a notice on November 5, 2025, disclosing that a hacking/IT incident compromised the records of 108,967 individuals. The unauthorized access occurred on a network server. This filing date reflects when the report was submitted to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details as the investigation proceeds, noting the large volume of affected records.

A California radiology group, Expert MRI, filed a breach report with HHS OCR on October 31, 2025. The filing indicates a hacking/IT incident compromised data stored on a network server, affecting 209,560 individuals. As a healthcare provider, Expert MRI is a covered entity under HIPAA. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data elements exposed and any required notifications to affected patients.

A Pennsylvania-based eye care provider, Tri Century Eye Care PC, filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on October 31, 2025, indicates that the personal information of 200,000 individuals was compromised. The breach originated from a network server. As a healthcare provider, this entity is a covered entity under HIPAA. Administrators should note this as a significant data security event in the ophthalmology sector. The submission date marks when the report was filed with the government, not necessarily when the incident occurred or was discovered. No further details on the specific data types or remediation steps are provided in this initial filing.

A Washington-based healthcare provider, Northwest Radiologists, Inc./Mount Baker Imaging, filed a report with HHS OCR regarding a hacking/IT incident. The submission, dated October 28, 2025, indicates that 362,713 individuals were affected. The breach involved unauthorized access to a network server. As a covered entity, this radiology group is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for similar incidents involving healthcare providers and review their own cybersecurity protocols, though no specific remediation steps are detailed in this filing.

A healthcare provider named Harbor has filed a report with HHS OCR regarding a hacking/IT incident. The breach involved unauthorized access to a network server, potentially exposing the protected health information of 216,000 individuals. The filing was submitted on September 30, 2025. As a covered entity, Harbor is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for notifications if their patients may be members of this organization, and review their own vendor contracts to ensure business associates have robust security measures for network servers.

Doctors Imaging Group, a healthcare provider in Florida, filed a breach report with HHS OCR on September 24, 2025. The filing covers a hacking/IT incident that compromised the personal health information of 171,862 individuals. The unauthorized access occurred on a network server. While this specific incident involves an imaging group, administrators at hospitals, clinics, and health plans should review their own vendor contracts and security monitoring protocols. The submission date marks when the report was filed, not necessarily when the breach occurred or was discovered. Organizations should verify if they share data with this entity or similar providers to assess potential downstream risks.

Sandhills Medical Foundation, a healthcare provider in South Carolina, reported a data breach to HHS OCR. The incident is classified as a hacking/IT incident, with data compromised on a network server. A total of 169,017 individuals were affected. The report was submitted on September 14, 2025. This filing highlights risks for providers and other covered entities. Administrators should review their own incident response plans. Ensure your breach notification procedures are current and ready for immediate deployment if a similar incident occurs at your organisation.

A Florida healthcare provider, Medical Associates of Brevard, LLC, has filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on September 5, 2025, indicates that the personal information of 246,711 individuals was compromised. The breach occurred on a network server. As a covered entity, this provider is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

A healthcare provider, Retina Group of Florida, filed a breach report with HHS OCR on September 3, 2025. The filing describes a hacking/IT incident that compromised data stored on a network server. The breach affected 152,691 individuals. This submission date is when the report was filed with the regulator, not necessarily when the incident occurred or was discovered. As a healthcare provider, this entity is a Covered Entity under HIPAA. Administrators at other organizations should note the scale of this incident involving a specialist group. Review your own incident response plans to ensure they address server-level compromises. Monitor for further details from the provider regarding the specific types of data exposed.

University of Iowa Health Care, a healthcare provider in Iowa, filed a breach notification with HHS OCR on August 29, 2025. The filing reports a hacking/IT incident involving data stored on a network server. The breach potentially affected 101,875 individuals. This submission date marks when the report was sent to the regulator, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor such filings to understand the scale of recent cyber threats facing large provider systems. While this specific incident involves a university health system, it highlights the ongoing risk of server-based attacks that can expose large volumes of patient records. No further details on the specific data types or remediation steps are provided in this summary record.

University of Iowa Community Home Care, a healthcare provider, filed a breach report with HHS OCR on August 29, 2025. The filing describes a hacking/IT incident involving a network server. The breach potentially affected 109,029 individuals. As a covered entity, the provider is required to notify affected patients and report the incident to the government. This submission date marks when the report was filed, not necessarily when the breach occurred. Healthcare administrators should monitor for similar IT security risks within their own networks and ensure their incident response plans are current.

A Florida-based radiology provider, Vital Imaging Medical Diagnostic Centers, LLC, filed a breach notification with HHS OCR on August 21, 2025. The filing reports a hacking/IT incident involving data stored on a network server. The breach potentially affected 111,509 individuals. As a covered entity, Vital Imaging is required to report this incident. Healthcare administrators should monitor for further details regarding the specific data elements compromised and any subsequent notifications to affected patients or regulators.

A Florida-based healthcare provider, MRI Associates of St. Pete, Inc. d/b/a Saint Pete MRI, filed a breach report with HHS OCR on August 19, 2025. The filing describes a hacking/IT incident involving a network server. The breach potentially affected 138,209 individuals. As a covered entity, the provider is required to notify affected patients and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

Highlands Oncology Group PA, an oncology practice in Arkansas, filed a breach report with HHS OCR on August 1, 2025. The filing covers a hacking/IT incident involving data stored on a network server. The breach potentially affected 111,766 individuals. As a healthcare provider, this entity is a Covered Entity under HIPAA. Administrators should note the scale of this incident for risk assessment purposes. The submission date is when the report was filed, not necessarily when the breach occurred or was discovered. No further details were provided in the initial filing.

Kettering Adventist Healthcare, a healthcare provider in Ohio, filed a breach report with HHS OCR on July 21, 2025. The filing indicates a hacking/IT incident compromised data on a network server, affecting 1,695,382 individuals. This submission date is when the report was sent to regulators, not necessarily when the breach occurred or was discovered. As a covered entity, the provider is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for official notifications if they serve patients in this region or have data-sharing agreements with the organization.

A healthcare provider in Maryland has reported a significant security incident to HHS OCR. Anne Arundel Dermatology filed a breach notification on July 11, 2025, stating that a hacking/IT incident compromised data on a network server. The filing indicates that 1,905,000 individuals were affected. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred or was discovered. As a covered entity, the dermatology group is required to report breaches affecting 500 or more individuals within 60 days of discovery. Healthcare administrators should note the scale of this incident for risk assessment purposes.

A major healthcare provider in Michigan, McLaren Health Care, has filed a report with HHS OCR regarding a significant hacking/IT incident. The filing, submitted on June 24, 2025, indicates that the personal information of 743,131 individuals was compromised. The breach originated from a network server within the organisation. While the submission date marks when the report reached regulators, it does not necessarily reflect when the incident occurred or was discovered. Healthcare administrators should monitor this situation as a reminder of the scale of potential cybersecurity risks facing large provider networks. This filing highlights the importance of robust data-breach response protocols and ongoing vigilance against hacking attempts targeting critical health infrastructure.

Harbin Clinic, LLC, a healthcare provider in Georgia, reported a hacking/IT incident to HHS OCR on May 16, 2025. The breach affected 176,149 individuals after unauthorized access to a network server. This filing date is when the report was submitted to the government, not necessarily when the incident occurred. Healthcare administrators should monitor for similar threats to their own network servers and ensure their incident response plans are current. While this specific event involves a provider, the risk of server-based attacks applies to all entities handling protected health information. Review your own security logs and vendor contracts to confirm adequate protections are in place against unauthorized access.

A healthcare provider operating under the City of Long Beach, CA, reported a hacking/IT incident to HHS OCR on April 14, 2025. The breach affected 258,191 individuals, with data compromised on a network server. This filing date reflects when the report was submitted to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor this case to understand how large-scale municipal provider breaches are handled. While this specific incident involves a city-run entity, the scale highlights the ongoing risk of server-based attacks. Review your own incident response plans to ensure they can handle mass notification requirements if a similar event impacts your organization.

Wisconsin-based ambulance provider Bell Ambulance, Inc. filed a breach report with HHS OCR on April 14, 2025. The filing indicates a hacking/IT incident compromised data stored on a network server, potentially affecting 237,830 individuals. As a healthcare provider, Bell Ambulance is a covered entity under HIPAA. This submission date reflects when the report was filed, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any required notifications to affected individuals.

A healthcare provider in Alabama has filed a breach notification with HHS OCR. Alabama Ophthalmology Associates reported that a hacking/IT incident compromised the protected health information of 131,576 individuals. The unauthorized access occurred on a desktop computer and a network server. This filing was submitted on April 8, 2025, which is the date the report was received by the regulator, not necessarily the date the breach occurred. As a covered entity, the provider is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for similar incidents involving network servers and ensure their own incident response plans are current.

Community Dental Care, Inc., a healthcare provider in Minnesota, filed a breach report with HHS OCR on March 28, 2025. The filing details a hacking/IT incident that compromised data on a network server, affecting 134,903 individuals. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred. As a covered entity, the dental group is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor this case to understand how large-scale data exposures are being reported in the dental sector, though no specific remediation steps are detailed in this filing.

SimonMed Imaging, a healthcare provider in Arizona, filed a report with HHS OCR on March 27, 2025, disclosing a hacking/IT incident. The breach compromised the protected health information of 1,275,669 individuals. The unauthorized access occurred on a network server. As a covered entity, SimonMed is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

A dental service organization, Chord Specialty Dental Partners (operated by CDHA Management, LLC and Spark DSO, LLC), filed a breach report with HHS OCR on March 14, 2025. The filing covers a hacking/IT incident involving email systems that exposed the protected health information of 173,430 individuals. As a healthcare provider in Tennessee, the entity is a Covered Entity under HIPAA. Administrators should note that this submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. This incident highlights the ongoing risks associated with email security in dental and specialty care settings.

Liberty Resources, Inc., a healthcare provider in New York, submitted a breach report to HHS OCR on March 4, 2025. The filing describes a hacking/IT incident that compromised data stored on a network server, affecting 103,711 individuals. As a covered entity, Liberty Resources must notify affected individuals and HHS OCR. This incident highlights the risk of server-based attacks for any organization handling protected health information. Healthcare administrators should review their own cybersecurity protocols to ensure network servers are secure against similar attacks.

A hacking/IT incident at Hillcrest Convalescent Center, Inc., a healthcare provider in North Carolina, has been reported to HHS OCR. The filing, submitted on March 4, 2025, indicates that data stored on a network server was compromised. This breach affects 106,194 individuals. Because the source record provides no web description, the specific types of data involved are not detailed here. Healthcare administrators should note this incident as a reminder to verify their own incident response plans and server security protocols. This is a confirmed report from a covered entity classified as a healthcare provider.

Community Care Alliance, a healthcare provider in Rhode Island, filed a breach report with HHS OCR on March 1, 2025. The filing indicates a hacking/IT incident compromised data stored on a network server. The breach affected 114,975 individuals. This submission date marks when the report was filed with the regulator, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any required notifications to affected patients or state authorities.

Escambia Community Clinics, Inc., operating as Community Health Northwest Florida, filed a breach report with HHS OCR on February 3, 2025. The healthcare provider disclosed that a hacking/IT incident compromised data stored on a network server. The filing indicates that 143,969 individuals were affected by this unauthorized access. As a covered entity, the clinic is required to report breaches of this scale. Administrators at similar community health centers and clinics should review their own server security protocols and incident response plans, noting that submission dates reflect when the report was filed, not necessarily when the breach occurred or was discovered.

Healthcare administrators should note that PIH Health, Inc., a healthcare provider in California, filed a report with HHS OCR for a significant data breach. The filing, submitted on January 31, 2025, indicates that a hacking/IT incident compromised the personal information of 2,947,264 individuals. The unauthorized access occurred on a network server. While this specific filing details the scope of the incident at PIH Health, it serves as a reminder for all covered entities to review their own cybersecurity protocols. This report reflects the submission date to the regulator, not necessarily the date the breach was discovered or announced to patients.

A Community Health Center, Inc. in Connecticut filed a breach notification with HHS OCR on January 30, 2025. The filing reports that a hacking/IT incident compromised the protected health information of 1,060,936 individuals. The unauthorized access involved data stored on an electronic medical record system and a network server. This submission date marks when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor this case to understand the scale of recent incidents affecting community health providers in the region.

A hacking/IT incident at Allegheny Health Network Home Medical Equipment LLC and Allegheny Health Network Home Infusion LLC in Pennsylvania compromised the data of 292,773 individuals. The breach occurred on a network server, and the healthcare provider submitted the report to HHS OCR on January 17, 2025. As a healthcare provider, this entity is directly responsible for reporting this incident. Administrators should note the scale of the exposure and the specific vulnerability of network servers to unauthorized access. This filing confirms the incident was reported to federal regulators, but does not detail the specific types of data lost or the timeline of the attack.

A North Carolina eye care provider, Asheville Eye Associates, PLLC, filed a breach report with HHS OCR on January 17, 2025. The filing describes a hacking/IT incident that compromised data stored on a network server. The breach affects 204,984 individuals. As a healthcare provider, the entity is a covered entity under HIPAA. This submission date reflects when the report was sent to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor for similar threats to their own network servers and ensure their incident response plans are current.

A healthcare provider in Kansas, Mid America Physician Services, filed a breach notification with HHS OCR on January 13, 2025. The filing reports a hacking/IT incident involving a network server that exposed the protected health information of 104,513 individuals. As a covered entity, the provider is required to report breaches affecting 500 or more people within 60 days of discovery. This submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred. Healthcare administrators should monitor such filings to understand the evolving threat landscape for cybersecurity risks targeting provider networks.

Texas Tech University Health Sciences Center, a healthcare provider in Texas, filed a breach report with HHS OCR on November 25, 2024. The filing describes a hacking/IT incident that compromised data stored on a network server. The breach potentially affected 650,000 individuals. This submission date marks when the report was sent to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor such large-scale incidents to understand evolving threat vectors, though no specific remediation steps are detailed in this filing.

A healthcare provider, Texas Tech University Health Sciences Center El Paso, filed a breach report with HHS OCR on November 25, 2024. The filing details a hacking/IT incident involving data stored on a network server. The breach potentially affected 815,000 individuals. As a covered entity, the university health sciences center is required to report such incidents. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should note the scale of this incident as a benchmark for risk assessment in their own operations.

A Colorado-based gastroenterology practice has filed a report with HHS OCR regarding a significant data security incident. The filing, submitted on November 13, 2024, indicates that a hacking or IT incident compromised information stored on a network server. This breach affects approximately 366,491 individuals. As a healthcare provider, the entity is required to notify affected patients and report the incident to the government. Healthcare administrators should note the scale of this exposure, which highlights the risks associated with network server vulnerabilities. While this specific event involves a specialty practice, the underlying threat vector is relevant to any organization managing electronic health records.

Great Plains Regional Medical Center, a healthcare provider in Oklahoma, filed a breach report with HHS OCR on November 7, 2024. The filing indicates a hacking/IT incident compromised data stored on a network server. The breach affected 133,149 individuals. This submission date reflects when the report was filed with the government, not necessarily when the incident occurred or was discovered. Healthcare administrators should review their own cybersecurity protocols and business associate agreements to ensure robust protections for patient data. While this specific incident involves a hospital system, the risk of server-based attacks applies to any entity handling patient data. Monitor HHS OCR updates for further details on the nature of the exposed information.

Summit Pathology and Summit Pathology Laboratories, Inc., a healthcare provider in Colorado, filed a breach report with HHS OCR on October 18, 2024. The filing covers a hacking/IT incident involving a network server that exposed the protected health information of 1,813,538 individuals. This submission date is when the report was filed with the government, not necessarily when the breach occurred. As a covered entity, Summit Pathology is responsible for notifying affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for notification letters if their patients or staff received pathology services from this organization, as the scale of this incident suggests widespread exposure of sensitive medical data.

Excelsior Orthopaedics, LLC, a healthcare provider in New York, reported a hacking/IT incident to HHS OCR on August 21, 2024. The filing indicates that 292,913 individuals were affected. The breach involved unauthorized access to a network server. While this submission date marks when the report was filed, it does not necessarily reflect when the incident occurred or was discovered. Healthcare administrators should review their own cybersecurity protocols, particularly regarding server security, to ensure patient data remains protected against similar threats.

Acadian Ambulance Service, Inc., a healthcare provider in Louisiana, filed a report with HHS OCR on August 20, 2024, disclosing a hacking/IT incident. The breach exposed the protected health information of 2,896,985 individuals. The compromised data was stored on a network server. This filing date reflects when the report was submitted to the government, not necessarily when the incident occurred or was discovered. Healthcare administrators should note the scale of this incident as a reminder of the risks associated with network security. While this specific event involves an ambulance service, the underlying vulnerability type is relevant to any organization managing electronic health records.

A healthcare provider in Colorado, Delta County Memorial Hospital District (Delta Health), filed a report with HHS OCR regarding a hacking/IT incident. The breach affected 148,363 individuals. The submission was made to the regulator on July 29, 2024. The compromised information was located on a network server. As a covered entity, the hospital district is required to report breaches of this scale. This filing confirms the incident was reported to federal authorities; it does not specify when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any required notifications to affected patients.

Medical Express Ambulance Inc., operating as Medex Ambulance in Illinois, filed a breach report with HHS OCR on May 2, 2024. The filing describes a hacking/IT incident where unauthorized access occurred on a network server. The breach potentially exposed the protected health information of 121,190 individuals. As a healthcare provider, Medex is a covered entity under HIPAA. This submission date reflects when the report was sent to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should review their own vendor contracts and security protocols to ensure similar network vulnerabilities are addressed.

Kootenai Health, a healthcare provider in Idaho, filed a report with HHS OCR on April 24, 2024, disclosing a significant hacking/IT incident. The breach compromised the protected health information of 464,088 individuals. The unauthorized access occurred on a network server. As a covered entity, Kootenai Health is required to notify affected individuals and report the incident to the government. Healthcare administrators should note the scale of this incident as a reminder of the risks associated with network server vulnerabilities. While this specific filing does not detail the exact nature of the data accessed, the volume of affected records highlights the potential impact of IT security failures on large provider organizations.

Delta Health System, a healthcare provider in Mississippi, filed a breach notification with HHS OCR on March 29, 2024. The filing reports a hacking/IT incident that compromised the protected health information of 216,532 individuals. The unauthorized access occurred on a network server. This submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should note this incident as a reminder of the risks associated with network infrastructure vulnerabilities. While this specific event involves a provider in Mississippi, the scale of the breach highlights the importance of monitoring IT security across all covered entities and business associates.