From ClingantryAI Health Regulator News

Healthcare administrators should note that Clover Health, a health plan operating in Minnesota, recently reported a significant data breach to HHS OCR. The incident, classified as a Hacking/IT Incident, affected 138,677 individuals. The breach involved information stored on a network server and other locations. This filing, submitted on September 14, 2026, highlights the ongoing cybersecurity risks faced by health plans and other healthcare entities. Organizations should review their own security protocols to protect patient data from similar threats.

Midwest Spine & Brain Institute, a healthcare provider in Minnesota, submitted a breach report to HHS OCR on August 14, 2026. The filing states that 108,487 individuals were affected by unauthorized access or disclosure of protected health information. The compromised data was located on a network server and other systems. This date reflects when the report was filed with the regulator, not when the incident occurred or was discovered. While secondary sources suggest the incident involved a vendor, 3C Care Systems, the official government record does not specify the cause or origin of the breach. Healthcare administrators should review this filing as an example of large-scale unauthorized access reporting.

Minnesota Epilepsy Group, a single-specialty outpatient practice, reported a hacking incident affecting 80,061 patients on June 5, 2026. The takeaway for any smaller or specialty practice: attackers aren't only targeting big hospital networks or national insurers. If your organization is smaller, that is not protection — you're still a target, and this-size breach is common.

The Minnesota Department of Human Services, a state health plan, filed a breach report with HHS OCR on January 16, 2026. The filing covers 303,965 individuals and cites unauthorized access or disclosure of data stored on a network server. Healthcare administrators should note that this is a reportable breach involving a large number of people. The record does not specify whether the access was external or internal, only that it was unauthorized. Monitor for further updates from the agency regarding remediation steps or additional notifications.