Five Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others

Five separate healthcare organizations, spanning primary care, oral surgery, eye care, and insurance benefits administration, disclosed patient data breaches in a single reporting cycle, a reminder that no corner of healthcare is insulated from security incidents.

This article covers what is known about each disclosure, what the HIPAA Breach Notification Rule requires, and what compliance officers at small-to-mid-size covered entities should take from this roundup. To be clear: these are breach disclosures, not enforcement actions. HHS OCR has not announced fines or penalties in connection with any of these incidents.

The Five Organizations

The HIPAA Journal reported on August 12, 2026 that the following organizations have each disclosed a separate security incident involving patient data:

• Family Medical Associates of Raleigh (primary care)
• Arkansas Oral & Maxillofacial Surgeons (oral surgery and dental)
• Alpine Agency of the Midlands (insurance or benefits administration)
• Princeton Family Eye Care (vision care)
• A fifth named provider disclosed in the same roundup

The number of patients affected at each organization has not been independently verified by medcomply.ai. Refer to the HIPAA Journal source and the HHS OCR breach portal for the most current figures as they become available.

What the HIPAA Breach Notification Rule Requires

Each of these organizations is now subject to the requirements of the HIPAA Breach Notification Rule. The core obligations are straightforward but operationally demanding, particularly for small organizations without dedicated compliance staff.

45 CFR §164.400 establishes the general requirement that covered entities notify individuals following the discovery of a breach of unsecured protected health information.

45 CFR §164.404 requires that affected individuals be notified without unreasonable delay and in no case later than 60 calendar days after the breach is discovered.

45 CFR §164.408 requires notification to HHS OCR. For breaches affecting 500 or more individuals, that notification must be submitted immediately. For smaller breaches, organizations may report annually, but the clock still starts at discovery.

45 CFR §164.406 addresses media notification. Organizations that experience a breach affecting 500 or more residents of a state or jurisdiction must also notify prominent media outlets in that area.

Meeting these deadlines while simultaneously conducting an investigation, securing affected systems, and communicating with patients is a significant operational burden. Organizations that lack a written incident response plan often find themselves scrambling to do all of this at once.

Why This Roundup Matters for Compliance Teams

The breadth of practice types in this single roundup is notable. An oral surgery practice, a primary care clinic, a vision care provider, and an insurance or benefits agency operate with very different workflows, software systems, and patient populations. They share one thing: each handles protected health information and each is required to meet the same HIPAA standards.

This pattern is consistent with what the HHS OCR breach portal shows over time: small covered entities are not breached because they are targeted specifically, but because they often lack the layered defenses that larger organizations have built over years of investment. Smaller practices may use cloud-based practice management software from vendors that have not been thoroughly evaluated under a formal vendor management program. They may not have tested their backup and recovery processes. They may not have a written risk analysis as required under 45 CFR §164.308(a)(1).

None of that is an excuse, but it is an explanation, and it points directly to what compliance officers at similar organizations should do next.

Immediate Steps for Similarly Situated Organizations

If your organization resembles any of the five named entities in practice type, size, or technology stack, consider the following actions:

Review your risk analysis. 45 CFR §164.308(a)(1) requires a thorough and accurate assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI your organization creates, receives, maintains, or transmits. If your last risk analysis is more than 12 months old, or was never formally documented, that is your starting point.

Confirm your incident response plan is written and tested. A breach notification timeline of 60 days sounds generous until your organization is managing a live incident. Written procedures, assigned roles, and at least one tabletop exercise significantly reduce the likelihood of missing a regulatory deadline.

Audit your business associate agreements. 45 CFR §164.308(b)(1) and 45 CFR §164.502(e) require that covered entities enter into business associate agreements with vendors who handle PHI on their behalf. Many small organization breaches trace back to a vendor relationship that was never formally documented or reviewed.

Check your notification templates. Breach notification letters to patients must include specific content under 45 CFR §164.404(c), including a description of what happened, the types of information involved, steps individuals should take to protect themselves, and contact information for your organization. Having a reviewed template ready before you need it saves critical time.

The Broader Compliance Context

Each new batch of breach disclosures adds data points to a pattern HHS OCR has cited repeatedly: the volume of breaches affecting smaller covered entities remains high, and the most common contributing factors, inadequate risk analysis, missing or outdated business associate agreements, lack of workforce training, and insufficient access controls, are not new problems. They are recurring failures at organizations that have not treated HIPAA compliance as an ongoing operational function.

These five disclosures will eventually appear on the HHS OCR breach portal, which is publicly searchable. Patients, journalists, state attorneys general, and plaintiff attorneys all monitor that portal. A breach disclosure is not the end of an organization's exposure; it is the beginning of a period of heightened scrutiny.