From ClingantryAI Health Regulator News

Healthcare organizations should note that **American Addiction Centers**, a **Business Associate** based in Tennessee, recently reported a significant **Hacking/IT Incident** to HHS OCR. This breach, submitted on **August 7, 2026**, impacted a **network server** and potentially exposed the protected health information of **327,754 individuals**. As a Business Associate, American Addiction Centers is responsible for safeguarding patient data under HIPAA, and this incident underscores the persistent cybersecurity risks faced by entities handling sensitive health information.

Anatomic and Clinical Laboratory Associates, P.C., a healthcare provider in Tennessee, submitted a breach notification to HHS OCR on June 23, 2026. The filing reports a hacking/IT incident involving a network server that exposed the data of 169,626 individuals. This submission date marks when the report was filed with regulators, not necessarily when the breach occurred or was discovered. As a covered entity, the laboratory is required to report breaches affecting 500 or more individuals within 60 days of discovery. Healthcare administrators should monitor for further details regarding the specific types of protected health information compromised and any subsequent notifications to affected individuals.

A business associate named Xsolis, Inc. filed a breach report with HHS OCR on June 5, 2026, disclosing a hacking/IT incident that compromised the data of 1,396,519 individuals. The unauthorized access occurred on a network server. Because Xsolis is a business associate, its clients—likely healthcare providers or health plans—may also have reporting obligations to their own patients or members. Administrators should verify if their organization uses Xsolis services and review internal protocols for handling third-party breach notifications. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered.

Xsolis — a company whose AI software helps hospitals and health plans decide whether a patient's stay or treatment gets approved — reported a hacking incident affecting 1,396,519 people on June 5, 2026. Why this one matters beyond the number: this isn't just a generic IT vendor, it's a vendor making decisions about patient care. If your hospital uses Xsolis or a similar utilization-review AI tool, this is worth a direct conversation with that vendor about what happened and whether your patients' data was involved.

A dental service organization, Chord Specialty Dental Partners (operated by CDHA Management, LLC and Spark DSO, LLC), filed a breach report with HHS OCR on March 14, 2025. The filing covers a hacking/IT incident involving email systems that exposed the protected health information of 173,430 individuals. As a healthcare provider in Tennessee, the entity is a Covered Entity under HIPAA. Administrators should note that this submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. This incident highlights the ongoing risks associated with email security in dental and specialty care settings.

A Business Associate serving addiction treatment providers, American Addiction Centers, Inc., filed a report with HHS OCR on November 25, 2024, disclosing a hacking/IT incident. The breach impacted 410,747 individuals, with protected health information accessed from a network server. Because American Addiction Centers acts as a Business Associate, the covered entities it serves—such as clinics and hospitals—may also have notification obligations to their own patients. Healthcare administrators should verify if their organization uses this vendor and review internal breach response protocols. This filing date reflects when the report was submitted to the government, not necessarily when the incident occurred or was discovered.