From ClingantryAI Health Regulator News

A healthcare provider in Illinois has reported a significant data breach to HHS OCR. Southern Illinois Dermatology filed a notice on April 2, 2026, stating that a hacking/IT incident compromised the personal information of 160,312 individuals. The unauthorized access occurred on a network server. This filing date represents when the report was submitted to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor their own systems for similar vulnerabilities and ensure their incident response plans are current, as large-scale provider breaches often signal broader industry threats.

Erie Family Health Centers, a healthcare provider in Illinois, submitted a breach notification to HHS OCR on March 27, 2026. The filing reports a hacking/IT incident that compromised the protected health information of 570,000 individuals. The breach occurred on a network server. This submission date reflects when the report was filed with the regulator, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any required notifications to affected patients.

Saint Anthony Hospital, a healthcare provider in Illinois, filed a breach notification with HHS OCR on March 6, 2026. The filing reports a hacking/IT incident that exposed the protected health information of 146,108 individuals. The compromised data was located in email systems. This submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should note the scale of this incident as a reminder of the risks associated with email-based communications and unauthorized access.

Alera Group, Inc., a business associate in Illinois, reported a hacking/IT incident to HHS OCR on July 29, 2025. The breach involved unauthorized access to a network server, exposing the protected health information of 155,567 individuals. As a business associate, Alera Group is required to notify its covered entity clients, who in turn must notify affected patients. Healthcare administrators should verify if their organization contracts with Alera Group and review any notifications received. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Monitor communications from vendors to ensure compliance with notification timelines.

RRCA Accounts Management Inc., an Illinois-based business associate, filed a report with HHS OCR on October 18, 2024, regarding a hacking/IT incident. The breach affected 115,837 individuals. The unauthorized access occurred on a desktop computer and a network server. As a business associate, RRCA handles protected health information on behalf of covered entities. If your organization contracts with RRCA for claims processing or similar services, review your business associate agreements and verify that you have received the required breach notification. This filing confirms the incident was reported to the federal regulator, but it does not specify the exact dates the data was compromised.

A business associate named Kerber, Eck & Braeckel LLP filed a breach report with HHS OCR on August 16, 2024. The filing covers a hacking/IT incident that compromised data for 134,918 individuals. The breached information was located on a network server. Because this entity is a business associate, your organization may be affected if you contract with them for services handling protected health information. Review your vendor contracts and security logs to determine if you are among the impacted covered entities. This submission date reflects when the report was filed with HHS, not necessarily when the breach occurred or was discovered.

Medical Express Ambulance Inc., operating as Medex Ambulance in Illinois, filed a breach report with HHS OCR on May 2, 2024. The filing describes a hacking/IT incident where unauthorized access occurred on a network server. The breach potentially exposed the protected health information of 121,190 individuals. As a healthcare provider, Medex is a covered entity under HIPAA. This submission date reflects when the report was sent to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should review their own vendor contracts and security protocols to ensure similar network vulnerabilities are addressed.