From ClingantryAI Health Regulator News

A business associate named Kerber, Eck & Braeckel LLP filed a breach report with HHS OCR on August 16, 2024. The filing covers a hacking/IT incident that compromised data for 134,918 individuals. The breached information was located on a network server. Because this entity is a business associate, your organization may be affected if you contract with them for services handling protected health information. Review your vendor contracts and security logs to determine if you are among the impacted covered entities. This submission date reflects when the report was filed with HHS, not necessarily when the breach occurred or was discovered.

A healthcare provider in Illinois has reported a significant data breach to HHS OCR. Southern Illinois Dermatology filed a notice on April 2, 2026, stating that a hacking/IT incident compromised the personal information of 160,312 individuals. The unauthorized access occurred on a network server. This filing date represents when the report was submitted to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor their own systems for similar vulnerabilities and ensure their incident response plans are current, as large-scale provider breaches often signal broader industry threats.

Alera Group, Inc., a business associate in Illinois, reported a hacking/IT incident to HHS OCR on July 29, 2025. The breach involved unauthorized access to a network server, exposing the protected health information of 155,567 individuals. As a business associate, Alera Group is required to notify its covered entity clients, who in turn must notify affected patients. Healthcare administrators should verify if their organization contracts with Alera Group and review any notifications received. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Monitor communications from vendors to ensure compliance with notification timelines.

Medical Express Ambulance Inc., operating as Medex Ambulance in Illinois, filed a breach report with HHS OCR on May 2, 2024. The filing describes a hacking/IT incident where unauthorized access occurred on a network server. The breach potentially exposed the protected health information of 121,190 individuals. As a healthcare provider, Medex is a covered entity under HIPAA. This submission date reflects when the report was sent to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should review their own vendor contracts and security protocols to ensure similar network vulnerabilities are addressed.