From ClingantryAI Health Regulator News

Healthcare organizations working with third-party vendors should note a recent breach reported by AngMar Management Services, a Business Associate based in Texas. The company submitted a breach filing to HHS OCR on September 16, 2026, indicating a Hacking/IT Incident that compromised a network server. This incident potentially exposed the protected health information of 126,196 individuals. As a Business Associate, AngMar Management Services is responsible for safeguarding patient data it handles on behalf of Covered Entities. This serves as a reminder for Covered Entities to ensure their Business Associate Agreements are robust and that vendors have strong security measures in place.

A healthcare provider, Baylor Genetics, filed a report with HHS OCR on August 14, 2026, disclosing a hacking/IT incident that compromised the data of 2,810,878 individuals. The breach occurred on a network server. This filing date is when the report was submitted to the government, not necessarily when the incident occurred or was discovered. Healthcare administrators should note the scale of this incident involving a major genetics laboratory. While no specific remediation steps are detailed in the filing, the sheer volume of affected records highlights the ongoing risks associated with large-scale data storage. Monitor official HHS OCR updates for further details on this specific case.

If you operate in Texas, there are two separate AI laws to know about, not one. The first, HB 149, is the broad rulebook for how AI systems can be used — it's been in effect since January 1, 2026. The second, SB 1188, is narrower but easy to overlook: it requires your staff to tell patients when AI was used in their diagnosis or treatment. That one has actually been in effect longer, since September 1, 2025. If your compliance team only checked the first law, you may already be missing a disclosure requirement that's been live for almost a year.

Nacogdoches Memorial Hospital, a healthcare provider in Texas, filed a breach report with HHS OCR on March 30, 2026, regarding a hacking/IT incident. The OCR portal lists 2,507,073 individuals affected. While some secondary sources cite a lower figure of 257,073, the federal record stands at 2.5 million with no documented correction. The breach involved data stored on a network server. As a covered entity, the hospital is responsible for notifying affected individuals. Healthcare administrators should monitor official notifications from the hospital to understand the specific scope of exposure for their own patients or partners, as the federal filing does not detail the specific types of data compromised.

A healthcare provider, North Texas Behavioral Health Authority, filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on March 6, 2026, indicates that 285,086 individuals were affected. The breach occurred on a network server. As a covered entity, the authority is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

A healthcare provider in Texas has reported a significant data breach to HHS OCR. The Denton MHMR Center filed a notice on November 5, 2025, disclosing that a hacking/IT incident compromised the records of 108,967 individuals. The unauthorized access occurred on a network server. This filing date reflects when the report was submitted to regulators, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details as the investigation proceeds, noting the large volume of affected records.

Texas Tech University Health Sciences Center, a healthcare provider in Texas, filed a breach report with HHS OCR on November 25, 2024. The filing describes a hacking/IT incident that compromised data stored on a network server. The breach potentially affected 650,000 individuals. This submission date marks when the report was sent to regulators, not necessarily when the incident occurred or was discovered. Healthcare administrators should monitor such large-scale incidents to understand evolving threat vectors, though no specific remediation steps are detailed in this filing.

A healthcare provider, Texas Tech University Health Sciences Center El Paso, filed a breach report with HHS OCR on November 25, 2024. The filing details a hacking/IT incident involving data stored on a network server. The breach potentially affected 815,000 individuals. As a covered entity, the university health sciences center is required to report such incidents. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should note the scale of this incident as a benchmark for risk assessment in their own operations.

A Texas-based business associate, VeriSource Services, Inc., filed a report with HHS OCR regarding a hacking/IT incident that compromised the data of 112,726 individuals. The breach involved unauthorized access to a network server. This filing was submitted on August 20, 2024, which is the date the report reached the regulator, not necessarily when the incident occurred or was discovered. Because VeriSource is a business associate, its clients—likely healthcare providers or health plans—may also have obligations to notify their own patients depending on the specific services provided. Administrators should check if their organization contracts with this vendor and review existing breach notification protocols.