Saber Healthcare and Law Firm Buchalter Disclose Patient Data Breaches; Bright Smile Dental Hit by Ransomware

A law firm handling legal work for a public hospital has disclosed a HIPAA-reportable breach, a detail that should catch the attention of any compliance officer who still treats outside counsel as outside the HIPAA compliance perimeter.

These are breach disclosures, not OCR enforcement actions. No fines have been announced in connection with any of the three incidents described below.

What Was Disclosed

Three separate organizations reported HIPAA-covered incidents, all surfacing on October 1, 2026, as reported by HIPAA Journal.

Saber Healthcare is an Ohio-based operator of skilled-nursing and senior-care facilities. The company disclosed a data breach affecting patient information. The specific nature of the incident and the number of individuals affected have not been confirmed in public reporting at this time.

Buchalter, a California-based law firm, disclosed a breach involving data connected to Arrowhead Regional Medical Center, a public hospital it serves. Because Buchalter was handling protected health information (PHI) on behalf of the covered entity, it was operating as a business associate under HIPAA. That means it is bound by the Security Rule and the Breach Notification Rule, regardless of the fact that it is a law firm rather than a clinical organization.

Bright Smile Dental Care, an Indiana dental practice, disclosed a ransomware attack. The practice stated that unauthorized access to patient data is considered unlikely, but the incident still triggered a HIPAA-reportable disclosure.

Why the Buchalter Disclosure Matters for Vendor Management

The Buchalter situation illustrates a risk that is easy to underestimate. Law firms regularly receive PHI when they assist covered entities with litigation, compliance matters, regulatory responses, or contract disputes. That access makes them business associates under 45 CFR §160.103, and it means they must comply with the full HIPAA Security Rule under 45 CFR §164.306 and report breaches to the covered entity in accordance with 45 CFR §164.410.

If your organization works with outside counsel and has not executed a business associate agreement (BAA) that includes security obligations and breach notification timelines, you have an open compliance gap. The Buchalter disclosure is a concrete reminder that this is not a theoretical concern.

Covered entities that receive notice of a breach from a business associate should also confirm whether their own 60-day notification clock under 45 CFR §164.404 has started. In many cases, the covered entity bears the notification obligation to affected individuals and to HHS, even when the breach originated at the BA.

The Ransomware Question at Bright Smile Dental Care

Ransomware incidents at small and mid-sized practices are not new, but they continue to pose a particular challenge because the affected organization often cannot confirm with certainty what data the attacker accessed or exfiltrated.

HHS guidance is clear: encryption of PHI by an unauthorized party, which is what ransomware does, constitutes unauthorized acquisition under the Breach Notification Rule unless the covered entity can affirmatively rule out access. The practice's statement that access is "considered unlikely" suggests the investigation may still be ongoing or that forensic evidence was limited.

For dental practices and other small covered entities evaluating their ransomware exposure, the relevant obligations include:

• Conducting and documenting a risk analysis under 45 CFR §164.308(a)(1)
• Maintaining offsite or cloud-based encrypted backups that ransomware cannot reach
• Logging access to PHI systems so that post-incident forensic review is possible
• Training staff to recognize phishing, which remains the most common ransomware entry point

What Saber Healthcare's Disclosure Signals for Senior Care

Long-term care operators manage some of the most sensitive PHI in the healthcare system, including clinical records, financial information, and data for patients who may not be able to advocate for themselves. A breach at a multi-site skilled-nursing operator raises questions about the consistency of security controls across facilities, the strength of vendor and contractor oversight, and whether breach detection and response capabilities are centralized or fragmented across locations.

Details about the scope and cause of Saber Healthcare's breach have not been confirmed in public reporting. Compliance teams at similar operators should treat this disclosure as a prompt to review their own network segmentation, access controls, and incident response plans.

Key Obligations Triggered by a Breach

Regardless of the specific facts of each incident, all three disclosures involve the same core regulatory framework. Covered entities and business associates that experience a breach of unsecured PHI must:

1. Notify affected individuals without unreasonable delay and no later than 60 days after discovery, under 45 CFR §164.404
2. Notify HHS, with breaches affecting 500 or more individuals reported within 60 days and smaller breaches logged in the annual report to HHS
3. Notify prominent media outlets in affected states if a breach involves 500 or more residents of that state, under 45 CFR §164.406
4. If a BA, notify the covered entity promptly under 45 CFR §164.410 so the covered entity can meet its own obligations

Failure to meet these timelines is itself a HIPAA violation, separate from the underlying breach.

Practical Steps for Compliance Teams

If you are a compliance officer, practice manager, or healthcare SaaS founder tracking these disclosures, here are actions worth taking now:

• Audit your BAA inventory. Confirm that every vendor, contractor, or law firm with access to PHI has a signed BAA that includes specific security requirements and breach notification timelines.
• Review your ransomware response plan. If your organization does not have a written, tested incident response procedure that addresses ransomware specifically, build one. Tabletop exercises are particularly useful for small practices.
• Check your breach log. Small breaches affecting fewer than 500 individuals must still be documented and reported to HHS annually. Consistent logging protects you if OCR ever reviews your compliance history.
• Assess your forensic capabilities. The ability to determine what data an attacker accessed, or did not access, is what allows an organization to rebut the presumption of breach. If you cannot reconstruct access logs after an incident, you cannot mount that defense.