HCA Healthcare, Blossom Health, El Camino Health, and UMMC Disclose Patient Data Breaches; Medusa Ransomware Linked to UMMC Incident

The breach at the University of Mississippi Medical Center was detected in March 2026. Patients were not formally notified until November 2026. That eight-month gap is the kind of compliance failure that tends to draw regulatory scrutiny, and it is happening alongside disclosures from three other healthcare organizations in the same news cycle.

To be clear at the outset: these are breach disclosures, not OCR enforcement actions. No fines have been announced. But the pattern across these four incidents offers a useful stress test for any covered entity or business associate reviewing its own breach response program.

What Was Disclosed and by Whom

HIPAA Journal reported on November 4, 2026 that four healthcare organizations disclosed patient data breaches around the same time:

• HCA Healthcare, one of the largest for-profit hospital systems in the United States, confirmed that roughly 55,000 individuals were affected. That group reportedly includes medical residents and patients at affiliated facilities. Exposed data is said to include Social Security numbers, medical information, and health insurance details.
• Blossom Health, a behavioral health provider, disclosed a breach affecting patient data. Specific details on the scope and data types involved were not included in the available reporting.
• El Camino Health, a Silicon Valley-based health system, also disclosed a breach. As with Blossom Health, the full scope is not detailed in the source reporting available to us.
• University of Mississippi Medical Center (UMMC), an academic medical center, disclosed a breach that has been linked to the Medusa ransomware group. UMMC first detected unusual activity in March 2026. Formal disclosure came in early November 2026.

Where details are limited, we have noted that explicitly. We will update this article as additional reporting becomes available.

The HCA Healthcare Third-Party Vendor Angle

The HCA Healthcare incident is reported to involve a third-party vendor access vector. That framing matters for compliance officers because it shifts the analysis toward business associate obligations and the adequacy of vendor oversight programs.

Under HIPAA, covered entities are required to enter into business associate agreements with any vendor that creates, receives, maintains, or transmits protected health information on their behalf. 45 CFR §164.308(b)(1) Those agreements must include provisions requiring the business associate to report breaches to the covered entity. 45 CFR §164.410

When a vendor is the access point for a breach, the covered entity does not escape its notification obligations. The covered entity is still responsible for notifying affected individuals and reporting to HHS. The business associate agreement is supposed to establish the timeline and mechanics for how that handoff works. If your BAA language is vague on breach reporting timelines or discovery definitions, an incident like the HCA one is the scenario where that vagueness becomes a real problem.

Questions worth asking now, before an incident occurs:

• Do your BAAs specify the timeframe within which a business associate must notify you of a suspected or confirmed breach?
• Does your vendor inventory include every entity that touches PHI, including subcontractors?
• Do you have a process for receiving, logging, and acting on breach notifications from vendors?

The Medusa Ransomware Connection at UMMC

The Medusa ransomware group has been active across multiple sectors, and healthcare has been a repeated target. Its link to the UMMC breach is significant for two reasons.

First, it confirms that academic medical centers, which often operate complex, federated IT environments with large numbers of endpoints and research systems, remain attractive targets for sophisticated ransomware actors.

Second, the timeline raises compliance questions that go beyond the technical. UMMC reportedly identified the incident in March 2026. Under 45 CFR §164.404, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days following discovery of a breach. If the March 2026 detection date is confirmed as the discovery date, a November 2026 notification falls well outside that window.

There is a narrow exception for law enforcement holds, which can delay notification under specific circumstances. 45 CFR §164.412 Whether that exception applies here has not been reported. Without a confirmed law enforcement hold or another documented justification, the delay is a material compliance concern.

Behavioral Health and the Blossom Health Disclosure

Blossom Health's disclosure is worth flagging separately for compliance officers who work with behavioral health providers. Behavioral health records often carry additional protections beyond standard HIPAA requirements, including those under 42 CFR Part 2 for substance use disorder treatment records. A breach at a behavioral health provider can therefore trigger a more complex notification and regulatory analysis than a breach involving general medical records.

If you are a business associate or technology vendor serving behavioral health providers, now is a reasonable time to confirm that your contracts and data handling practices account for those additional requirements.

What the Timing of These Disclosures Tells Us

Four healthcare organizations disclosing breaches in the same news cycle is not unusual. HHS's breach portal, sometimes called the "Wall of Shame," regularly shows clusters of disclosures from organizations that may have experienced incidents weeks or months earlier. The 60-day notification window means that breach disclosures often appear long after the underlying incident.

What is worth noting is the spread of organization types in this roundup: a large for-profit system, a behavioral health provider, a community health system, and an academic medical center. Breaches are not concentrated in any single type of covered entity. Smaller organizations sometimes assume that ransomware groups or sophisticated attackers focus only on large systems. The Blossom Health and El Camino Health disclosures, alongside UMMC and HCA, are a reminder that the attack surface is broad.

Practical Steps for Compliance Officers

If these disclosures prompt a review of your own program, the following areas are worth prioritizing:

Breach discovery and the 60-day clock. Make sure your incident response plan defines what constitutes "discovery" of a breach and that your team understands the clock starts at that point. Ambiguity in this definition has caused organizations to miss notification deadlines. 45 CFR §164.404(a)(2)

Vendor breach notification clauses. Pull a sample of your current BAAs and check whether they require vendors to notify you within a defined period, ideally no more than 10 to 15 business days after the vendor discovers a potential breach. The HIPAA rule does not specify a sub-deadline for BAA notification, but your agreements should.

Ransomware response planning. If your incident response plan does not include a ransomware-specific scenario, it should. That scenario should address when to involve law enforcement, whether and how to engage with threat actors, and how to document the timeline for regulatory purposes.

Risk analysis currency. 45 CFR §164.308(a)(1) requires covered entities to conduct an accurate and thorough assessment of potential risks to PHI. If your most recent risk analysis predates the current ransomware threat landscape, it may no longer reflect the actual risk environment.