Manhattan Law Firm Tarter Krinsky & Drogin Reports PHI Breach Affecting 196,645 Patients; Park Dental and Heritage Pediatrics Also Disclose Incidents

A Manhattan law firm acting as a business associate to healthcare clients has disclosed a breach of protected health information belonging to a reported 196,645 patients, making it one of the larger non-clinical business associate breaches reported in recent memory.

This is a breach disclosure, not an OCR enforcement action. No fine or corrective action plan has been announced as of the date of this article.

What Happened

Tarter Krinsky & Drogin, a New York-based law firm, reported that a breach exposed the PHI of nearly 197,000 individuals associated with its healthcare clients. Affected individuals were notified on or around October 19, 2026. The firm serves healthcare clients and, in doing so, qualifies as a business associate under HIPAA.

The categories of data potentially exposed are broad and serious. According to reporting from HIPAA Journal, exposed information may include:

• Social Security numbers
• Financial account details
• Health insurance information
• Clinical records

The breadth of data types is notable. Breaches that combine financial identifiers with clinical records create compounded risks for affected individuals, including identity theft, insurance fraud, and unauthorized disclosure of sensitive health conditions.

Why Business Associate Breaches Deserve Extra Attention

Healthcare organizations have invested heavily in securing their own clinical systems. Many have underestimated the risk posed by the vendors, counsel, and partners who touch PHI upstream and downstream of direct patient care. Law firms, billing companies, consultants, and technology vendors are all potential business associates, and each one extends the attack surface of every covered entity they serve.

Under 45 CFR §164.308(b), covered entities are required to obtain satisfactory assurances from business associates that PHI will be appropriately safeguarded. Those assurances must be memorialized in a business associate agreement, as required by 45 CFR §164.504(e).

But a signed agreement alone is not a security control. The obligation to assess vendor risk does not end at contract execution. Covered entities should periodically evaluate whether their business associates are maintaining the administrative, physical, and technical safeguards required under 45 CFR §164.306.

When a business associate suffers a breach, the covered entity's own breach notification obligations may be triggered. Under 45 CFR §164.410, business associates must notify covered entities of a breach without unreasonable delay and no later than 60 days after discovery. The covered entity then determines whether notification to affected individuals, the media, and the Department of Health and Human Services is required under 45 CFR §164.400 through 45 CFR §164.414.

Park Dental and Heritage Pediatrics Also Report Incidents

Separately, Park Dental in Virginia and Heritage Pediatrics in Texas disclosed breach incidents around the same reporting period. Based on available reporting, these appear to be unrelated to the Tarter Krinsky & Drogin incident. Details on the scope and nature of those breaches were limited at the time of this article's publication.

The simultaneous appearance of multiple breach disclosures is not unusual. HHS breach reporting windows and internal investigation timelines often produce clusters of disclosures. Each incident should be evaluated on its own facts.

What Covered Entities and Business Associates Should Do Now

If your organization works with outside legal counsel, billing vendors, or any third party that accesses PHI, now is a practical moment to take the following steps:

Review your business associate agreements. Confirm that agreements are current, executed, and include all required provisions under 45 CFR §164.504(e). Agreements that predate recent regulatory guidance may be missing key provisions.

Assess your vendor's security posture. A BAA is a legal instrument, not a security audit. Consider requesting evidence of security controls, such as SOC 2 reports, penetration test summaries, or written security policies, from vendors who handle significant volumes of PHI.

Confirm your breach response protocol. Know in advance how you will respond if a business associate notifies you of a breach. Your incident response plan should address vendor-originated incidents explicitly, including escalation paths, legal notification timelines, and patient communication workflows.

Document your risk assessments. Under 45 CFR §164.308(a)(1), covered entities and business associates must conduct accurate and thorough assessments of the potential risks and vulnerabilities to PHI. If a breach occurs, documentation of a prior risk assessment is one of the most important artifacts you can present to regulators.

The Bigger Picture

The Tarter Krinsky & Drogin disclosure is a reminder that the healthcare compliance perimeter does not end at the walls of a clinic or hospital. Every organization that handles PHI on behalf of a covered entity carries compliance obligations and security risk. The larger the vendor's client portfolio, the greater the potential blast radius of a single incident.

Reported at roughly 196,645 affected individuals, this breach will likely appear on the HHS Wall of Shame and may draw regulatory scrutiny depending on the findings of any subsequent investigation. Whether it leads to enforcement action will depend on factors including how the breach occurred, how quickly it was discovered and reported, and what safeguards were in place at the time.

Compliance officers should monitor this case as it develops.