University Hospitals (Cleveland) Still Offline Weeks After October 22 Cyberattack; EyeMed Vision Care and Facial Surgery Group Also Report Incidents

More than ten days after identifying a cyberattack on October 22, 2026, University Hospitals, a 21-hospital health system based in Cleveland, Ohio, confirmed in a November 2 update that systems were still offline. Around the same time, vision-benefits administrator EyeMed Vision Care disclosed a separate breach affecting at least 500 California residents, and Facial Surgery Group reported its own cybersecurity incident. HIPAA Journal covered all three disclosures in a November 4 article.

These are reported data breaches and cybersecurity incidents, not HIPAA enforcement actions. No fine or resolution agreement has been announced in connection with any of these events.

What We Know About Each Incident

University Hospitals, Cleveland

University Hospitals identified the cyberattack on October 22, 2026. As of its November 2 public update, systems remained offline. The nature of the attack, the category of data involved, and the number of individuals potentially affected had not been confirmed in the reporting available at the time of publication. The organization has not publicly stated whether it has made the required notifications under the HIPAA Breach Notification Rule, though the 60-day clock under 45 CFR §164.404 would run from the date the breach was discovered, not from the date systems are restored.

The prolonged outage raises immediate questions under the HIPAA Security Rule's contingency planning requirements. Covered entities are required to maintain a data backup plan, a disaster recovery plan, and an emergency mode operation plan under 45 CFR §164.308(a)(7). A multi-week outage across a system of this size puts those contingency measures under real operational stress.

EyeMed Vision Care

EyeMed Vision Care, which administers vision benefits on behalf of health plans and therefore functions as a business associate under HIPAA, disclosed a breach affecting at least 500 California residents. The California figure comes from a state-level filing; the total number of individuals affected has not been confirmed in available reporting.

Business associates that experience a breach are required under 45 CFR §164.410 to notify the affected covered entity or entities without unreasonable delay and no later than 60 calendar days after discovering the breach. The covered entity then carries the obligation to notify affected individuals under 45 CFR §164.404. If the total number of affected individuals reaches 500 or more in a given state, the covered entity must also provide media notice under 45 CFR §164.406 and notify HHS contemporaneously rather than in the annual log submission.

Covered entities that use EyeMed as a vision-benefits administrator should confirm they have received formal breach notification and review their business associate agreements to verify the contractually required internal reporting window, which is often set shorter than the 60-day regulatory maximum.

Facial Surgery Group

Facial Surgery Group also reported a cybersecurity incident. No additional details regarding the nature of the attack, the data involved, or the number of individuals affected were available in the source reporting at the time this article was written. The incident is noted here because it was disclosed in the same reporting cycle, illustrating that smaller specialty practices face the same threat environment as large integrated health systems.

Why the Timing of These Disclosures Matters

Three separate healthcare entities disclosing incidents within the same reporting window is not coincidence in any conspiratorial sense, but it does reflect the persistent and broadening threat landscape facing healthcare. Attackers target health data because it is valuable, and they target the connections between covered entities and their business associates because those relationships often carry large data volumes with less centralized security oversight.

The convergence of a prolonged major health system outage with business associate and specialty-practice disclosures is a scenario that stress-tests several HIPAA obligations simultaneously:

• Breach notification timing. The 60-day clock under 45 CFR §164.404 does not reset because systems are down. Notification obligations accumulate even during active remediation.
• Business associate agreement terms. If a BA's internal reporting window is not contractually specified, covered entities may not learn of a breach in time to meet their own obligations. 45 CFR §164.314(a)(2)(i)(C) requires BAAs to obligate the BA to report breaches to the covered entity.
• Contingency planning. A multi-week outage is precisely the scenario that HIPAA's contingency-planning standards under 45 CFR §164.308(a)(7) are designed to address. Organizations should be able to demonstrate that they activated documented plans, not improvised responses.
• Workforce workarounds. Extended outages create pressure on clinical and administrative staff to use personal devices, personal email, or other unsecured channels. Those workarounds create independent HIPAA risks under the Security Rule's workstation and device standards.

What Compliance Teams Should Do Now

Even if your organization has no direct relationship with University Hospitals, EyeMed Vision Care, or Facial Surgery Group, these disclosures provide a useful forcing function for several near-term compliance actions.

Review your business associate inventory. Confirm that you have a current, executed BAA with every vendor that creates, receives, maintains, or transmits protected health information on your behalf. Confirm that each BAA includes a breach-notification obligation with a defined internal reporting window.

Check your breach-notification procedures. Walk through your incident-response plan and confirm that your team knows how to calculate the 60-day clock, who is responsible for authorizing notifications, and how notifications will be delivered if systems are partially or fully offline.

Test your contingency plans. If your organization has not tabletop-tested its disaster recovery and emergency mode operation plans recently, a multi-week peer-institution outage is a reasonable prompt to schedule that exercise.

Document everything contemporaneously. In the event of a future OCR investigation, documentation of the steps taken and the decisions made during and after a security incident is a primary factor in how the agency evaluates an organization's good-faith compliance efforts.