Photon Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health

A ransomware group has publicly claimed responsibility for an attack on a healthcare technology vendor, making the Photon Health incident one of three concurrent breach disclosures that surfaced in mid-October 2026 affecting patient protected health information across New York and Texas.

To be clear at the outset: these are breach disclosures, not enforcement actions. No OCR fine or corrective action plan has been announced in connection with any of these incidents.

What Happened

HIPAA Journal reported on October 13, 2026, that three organizations disclosed data security incidents affecting patient PHI:

• Photon Health, a healthcare technology company based in New York
• Healthcare Highways, a medical provider network company based in Texas
• Any-Time Home Care, a home health agency based in New York

The Direwolf ransomware and data extortion group has claimed responsibility for the attack on Photon Health. Patient notification letters have been issued by all three organizations. As of the publication date, the full count of individuals affected has not been confirmed on the HHS breach portal for any of the three incidents.

Why the Photon Health Incident Carries Elevated Risk

When a ransomware group publicly names a target and claims an attack, it typically signals that data exfiltration is part of the threat model, not just encryption. This matters because exfiltration creates a separate and persistent exposure risk even after systems are restored. Affected individuals may face ongoing risks from their PHI circulating in criminal marketplaces.

Photon Health, as a healthcare technology company, likely functions as a business associate under HIPAA for the covered entities it serves. Business associates that experience breaches must notify their covered entity clients without unreasonable delay and no later than 60 days after discovery of the breach, per 45 CFR §164.410. Covered entities then carry their own notification obligations to affected individuals and, depending on the size of the breach, to HHS and potentially to prominent media outlets in the affected state, per 45 CFR §164.404 and 45 CFR §164.406.

The Business Associate Risk Pattern

All three disclosures fit a pattern that HIPAA compliance professionals have watched escalate over the past several years: breaches originating at or involving vendors, networks, and agencies that sit between patients and their primary care providers.

Healthcare Highways operates as a provider network company. Any-Time Home Care provides home health services. Both operate in contexts where PHI flows across organizational boundaries, often governed by business associate agreements. The adequacy of those agreements, and the security controls underlying them, become central questions once a breach is disclosed.

HIPAA's Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic PHI, per 45 CFR §164.306. This includes conducting accurate and thorough risk analyses, per 45 CFR §164.308(a)(1), and having contingency plans in place for responding to incidents such as ransomware attacks, per 45 CFR §164.308(a)(7).

What the HHS Breach Portal Will Tell Us Later

The HHS "Wall of Shame" breach portal is the public record for HIPAA-reportable breaches affecting 500 or more individuals. As of the publication date, the entries for these three incidents have not been confirmed. Once posted, the portal will provide the reported breach count, the type of PHI involved, and the location of breached information. Compliance officers and legal teams tracking these incidents should monitor the portal directly at hhs.gov/hipaa.

For breaches affecting fewer than 500 individuals, covered entities are required to notify HHS within 60 days of the end of the calendar year in which the breach was discovered, per 45 CFR §164.408.

Immediate Steps for Covered Entities

If your organization has a business associate agreement or data-sharing relationship with Photon Health, Healthcare Highways, or Any-Time Home Care, the following steps are worth taking now:

1. Contact your counterpart at the organization to ask directly whether your patients' PHI was involved.
2. Pull your business associate agreement and confirm that breach notification timelines and responsibilities are clearly defined.
3. Document the date you learned of the potential breach. The 60-day notification clock under 45 CFR §164.404 runs from the date of discovery, and your organization's discovery date may differ from the vendor's.
4. Assess whether your own risk analysis needs to be updated to reflect vendor-side ransomware as an identified threat, per 45 CFR §164.308(a)(1).
5. Review your incident response plan to confirm you have a process for handling downstream breach notifications from business associates.

What We Do Not Yet Know

Several material facts remain unconfirmed as of publication:

• The number of individuals affected at each organization
• The specific categories of PHI involved in each incident
• Whether any of the three organizations has completed its own forensic investigation
• The full scope of Direwolf's access at Photon Health, including whether data was exfiltrated

Medcomply.ai will update this article as HHS breach portal entries are confirmed and additional details become public.