Four Healthcare Entities Disclose New Breaches: Cognitive Health Technologies, City Ambulance Service, Baraga County Memorial Hospital, and Others

A healthcare IT and consulting vendor based in New York has reported a breach affecting a reported 49,467 individuals, making it the largest of five newly disclosed incidents now appearing on the HHS breach portal. These are breach disclosures, not OCR enforcement actions, and no fines have been announced in connection with any of them.

The Cognitive Health Technologies Incident: Why Vendor-Side Exposure Matters

Cognitive Health Technologies LLC, headquartered in New York, is classified in this disclosure as an IT or healthcare technology vendor. That classification matters enormously to covered entities. If Cognitive Health Technologies was processing or storing protected health information on behalf of covered entities, it almost certainly operated as a business associate under HIPAA, and the covered entities it served may have their own notification and risk assessment obligations to fulfill.

Business associate agreements are supposed to require vendors to notify covered entities of a breach without unreasonable delay and no later than 60 days after discovery. 45 CFR §164.410 If you have a relationship with Cognitive Health Technologies, the time to verify notification status and assess your exposure is now, not after a patient complaint lands in your inbox.

The incident description references an IT-related cause, though the specific nature of the breach, whether it involved ransomware, unauthorized access, or some other vector, has not been detailed in public sources as of this writing. Compliance teams should not assume the breach was limited to one system or one data type until the entity provides a formal breach notification letter.

Baraga County Memorial Hospital: A Fresh HHS Portal Entry

Baraga County Memorial Hospital, a critical access hospital in Michigan, has been added to the HHS breach portal with a reported cause of unauthorized system access. The portal currently lists 501 affected individuals, which is the standard HHS placeholder figure used when a covered entity has not yet confirmed the final count.

Critical access hospitals often operate with leaner IT and compliance staffing than larger health systems, which can make incident response and forensic investigation more resource-intensive relative to capacity. The 501 placeholder should not be read as confirmation that only 501 individuals were affected. The final number, once the investigation closes, may be substantially higher.

Unauthorized access incidents trigger a full breach notification analysis under 45 CFR §164.402, including an assessment of whether the access constitutes a breach of unsecured PHI and whether the presumption of breach has been rebutted by a documented risk assessment.

City Ambulance Service, The Speech Clinic, and Innovative Alternatives

Three additional entities have also disclosed breaches in this reporting cycle:

City Ambulance Service in Texas appears on the HHS portal as a newly reported incident. Emergency medical services providers handle highly sensitive PHI, including patient condition data, transport records, and billing information, and are covered entities under HIPAA when they transmit health information electronically in connection with standard transactions. 45 CFR §164.104

The Speech Clinic in Georgia and Innovative Alternatives in Texas round out the five disclosures. Specific details about the nature of these breaches and the number of individuals affected were not available in the source reporting at the time of publication. Compliance teams in those states, or organizations with referral or data-sharing relationships with any of these entities, should monitor the HHS portal for updates.

What the Roundup Format Tells Us About HHS Portal Cadence

The HHS Office for Civil Rights adds breach entries on a rolling basis. Roundup reporting from outlets like HIPAA Journal captures clusters of new additions that can otherwise be easy to miss if your team is not checking the portal regularly. Five breaches disclosed in a single news cycle, spanning ambulance services, behavioral health technology, critical access hospitals, outpatient clinics, and specialty service providers, illustrates how broadly HIPAA breach risk is distributed across the healthcare ecosystem.

For compliance officers using the HHS portal as a monitoring tool, entries showing 501 as the individual count are worth flagging for follow-up. That number is almost always provisional.

Immediate Steps for Compliance Teams

If your organization has a business associate relationship with Cognitive Health Technologies or any of the other entities listed here, the following steps apply:

1. Verify whether your organization received a formal breach notification from the vendor or provider.
2. Pull the relevant business associate agreement and confirm the notification timeline and obligations. 45 CFR §164.410
3. Conduct and document a risk assessment to determine whether unsecured PHI was involved and whether the presumption of breach applies. 45 CFR §164.402
4. If notification to affected individuals is required, calendar the 60-day deadline from the date of discovery. 45 CFR §164.404
5. Notify HHS if the breach affects 500 or more individuals in a state, or log it for the annual report if it affects fewer. 45 CFR §164.408

Even if your organization has no direct relationship with these entities, this roundup is a useful prompt to audit your own vendor roster and confirm that all business associates have current, executed BAAs on file.