Mid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents

Over 85,000 patients had their protected health information exposed at a single dermatology and plastic surgery group, making the Mid Florida Dermatology & Plastic Surgery breach one of the larger provider-side incidents reported to HHS in this cycle.

This is a breach disclosure, not an OCR enforcement action. No fine, civil monetary penalty, or resolution agreement has been announced in connection with any of the three incidents described in this article.

What Happened at Mid Florida Dermatology & Plastic Surgery

Mid Florida Dermatology & Plastic Surgery, a medical group operating reported at roughly 33 locations across central Florida, filed a breach report with the Department of Health and Human Services listing 85,585 affected individuals. The triggering event, according to available reporting, was the detection of unusual activity in the organization's computer systems on March 30, 2026.

The breach was newly listed on the HHS breach portal as of the October 16, 2026 reporting covered by HIPAA Journal. The specific type of data involved and the precise nature of the system activity have not been publicly detailed in the source material available at the time of this article.

Breach Notification Obligations in Context

Under HIPAA's Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and within 60 days of discovering a breach. 45 CFR §164.404 For a breach of this scale, affecting more than 500 individuals, simultaneous notification to prominent media outlets in the states where affected individuals reside is also required. 45 CFR §164.406 Covered entities must also notify HHS within the same 60-day window when a breach affects 500 or more individuals. 45 CFR §164.408

The gap between the March 30, 2026 detection date and the October 2026 portal appearance warrants attention. Compliance officers reviewing their own incident response timelines should confirm that their internal escalation procedures, forensic investigation workflows, and legal review processes can operate within the 60-day statutory window without compressing the notification quality.

Kannarr Eye Care and Indiana University Health Also Report Incidents

Two additional covered entities appeared on the HHS breach portal in the same reporting cycle.

Kannarr Eye Care, an eye care provider based in Kansas, filed a breach notification with HHS. Details about the number of affected individuals and the nature of the incident were not available in the source material for this article.

Indiana University Health Affiliated Covered Entity, a large health system affiliated covered entity in Indiana, also reported an incident. As with Kannarr, specific details about scope and incident type were not detailed in the available source reporting.

There is no reported connection among the three incidents. Their concurrent appearance on the HHS portal reflects the portal's rolling update cycle rather than any shared cause or coordinated attack.

Why Multi-Entity Breach Roundups Matter for Compliance Teams

When multiple covered entities appear on the HHS portal within the same news cycle, it creates a useful reference point for benchmarking your organization's own readiness. Compliance officers and practice managers should ask:

• Does your organization have a documented process for detecting unusual system activity, and does that process specify who is responsible for escalating to your privacy officer?
• Is your business associate agreement inventory current, particularly for any vendors with access to systems across multiple clinic locations? 45 CFR §164.308(b)
• Has your workforce received training on recognizing and reporting anomalous system behavior as part of your security awareness program? 45 CFR §164.308(a)(5)

For healthcare SaaS founders whose platforms touch covered entity data, these breach disclosures are a reminder that your customers' breach risk can become your business risk if your contractual and technical controls are not aligned with HIPAA's requirements for business associates. 45 CFR §164.314

What to Watch

OCR has discretion to open investigations following large breach disclosures, particularly where the affected population exceeds tens of thousands of individuals. There is no indication that an investigation has been opened for any of these three incidents, and no enforcement action has been announced. That status could change. Organizations in similar situations should preserve forensic evidence, document their response timeline carefully, and ensure that any required notifications have been completed accurately and on time.