From ClingantryAI Health Regulator News

A health plan, Delta Dental of Virginia, filed a breach notification with HHS OCR on November 21, 2025. The filing reports a hacking/IT incident that compromised the protected health information of 126,953 individuals. The breached data was located in email systems. This submission date reflects when the report was filed with the government, not necessarily when the breach occurred or was discovered. As a covered entity, the health plan is required to report breaches affecting 500 or more individuals within 60 days of discovery. Healthcare administrators should monitor for further details regarding the specific data elements exposed and any required notifications to affected individuals.

A Virginia-based radiology group, Radiology Associates of Richmond, has filed a report with HHS OCR regarding a significant security incident. The filing, submitted on May 21, 2026, indicates that a hacking/IT incident compromised data stored on a network server. This breach affects a substantial number of individuals, with 266,183 people impacted. As a healthcare provider, the entity is a Covered Entity under HIPAA rules. Administrators should note that this submission date reflects when the report was filed with regulators, not necessarily when the breach occurred or was discovered. Given the scale of the incident, this serves as a reminder of the risks associated with network server vulnerabilities in medical imaging and diagnostic settings.

Radiology Associates of Richmond, Inc., a Virginia-based healthcare provider, filed a breach notification with HHS OCR on July 1, 2025, reporting a hacking/IT incident affecting 1,419,091 individuals. The data was accessed from a network server. This entity has since disclosed a second, separate breach involving 266,183 individuals, stemming from an incident on or about July 25, 2025. This subsequent disclosure was reported to the Maine Attorney General on May 21, 2026. However, claims that this second breach has appeared on HHS OCR's public breach portal are unsupported by primary sources and contradicted by contemporaneous reporting stating it had not yet appeared. The HHS OCR record for the initial filing indicates no business associate was involved. Administrators should monitor the OCR portal for updates on both incidents.

Richmond Behavioral Health Authority in Virginia has reported a significant data breach affecting 113,232 individuals. The incident, classified as a hacking or IT incident, involved unauthorized access to a network server. The report was submitted to HHS OCR on November 28, 2025. Hospital administrators should monitor this case to understand how large-scale server breaches are being handled and reported. While this specific event affects a behavioral health provider, the scale highlights the ongoing risk to network infrastructure across all healthcare sectors. Ensure your own IT security protocols are robust and that your breach response plan is current.