Data Breach
A central Florida dermatology group with 33 locations has notified HHS of a breach affecting more than 85,000 patients after detecting unusual computer system activity in March 2026. Two other covered entities reported incidents concurrently.
Updated Oct 17, 20265 min read
Data Breach
A voice phishing attack at Central Ohio Primary Care Physicians exposed protected health information for roughly 1.4 million individuals. Here is what compliance officers need to know about the breach, the data involved, and HIPAA obligations.
Updated Oct 16, 20266 min read
Data Breach
A high-severity authentication bypass zero-day in Ivanti Connect Secure is being actively exploited, giving unauthenticated attackers a direct path to ePHI. Here is what HIPAA-covered entities and business associates need to do right now.
Updated Oct 14, 20266 min read
Data Breach
Ransomware group Metaencryptor has claimed an attack on MyMichigan Health, a University of Michigan-affiliated system serving 26 Michigan counties. No public confirmation or HHS filing has appeared as of October 13, 2026. Here is what compliance officers need to watch.
Updated Oct 14, 20266 min read
Data Breach
Three healthcare organizations disclosed data breaches in October 2026, including a ransomware claim by the Direwolf group against health tech vendor Photon Health. Here is what compliance officers need to know.
Updated Oct 14, 20265 min read
Data Breach
A Texas Attorney General report reveals the 2025 Oracle Health cyberattack on legacy Cerner servers may have compromised nearly 20 million people, raising serious HIPAA business associate liability questions for hospital customers nationwide.
Updated Oct 9, 20265 min read
Data Breach
Ohio-based Saber Healthcare, California law firm Buchalter, and Indiana dental practice Bright Smile Dental Care have each disclosed HIPAA-reportable incidents. Here is what compliance teams need to know.
Updated Oct 2, 20266 min read
Data Breach
The District of Columbia Department of Health Care Finance disclosed that Medicaid beneficiary data was publicly accessible online for roughly three years, affecting nearly 400,000 enrollees. Here is what compliance officers need to know.
Updated Oct 1, 20266 min read
Data Breach
MedImpact Healthcare Systems, a large pharmacy benefit management business associate, began mailing breach notification letters in September 2026 for a network intrusion that occurred in October 2025. The nearly year-long gap between incident and notification raises serious HIPAA breach notification rule compliance questions.
Updated Sep 25, 20266 min read
Data Breach
A cyberattack on Aesto Health's Amazon Web Services infrastructure exposed the records of roughly 9.54 million patients across 30 covered entity clients. Here is what compliance officers need to know about third-party risk, BAA oversight, and the breach timeline.
Updated Sep 4, 20266 min read
Data Breach
TheGentlemen ransomware group has claimed an attack on Nutex Health and is threatening to publish stolen patient data. A class action lawsuit was filed in Texas just three days after Nutex's SEC 8-K disclosure, raising urgent questions about hospital-sector ransomware liability.
Updated Sep 4, 20264 min read
Data Breach
The ShinyHunters extortion group claims it leaked 7.1 million Salesforce records from Baxter International containing patient PII. Here is what compliance officers and healthcare vendors need to know about the HIPAA risk exposure.
Updated Aug 22, 20265 min read
Data Breach
CareCloud, a cloud-based EHR and practice management vendor, disclosed a breach affecting roughly 345,000 individuals. Learn what was exposed, what compliance obligations this triggers, and what covered entities and business associates should do now.
Updated Aug 14, 20265 min read
Data Breach
Optalis Management Solutions, a Michigan-based skilled nursing and rehabilitation management company, notified 13,723 individuals of unauthorized network access occurring April 14–19, 2025. At least one additional entity disclosed an email breach exposing sensitive patient data. Neither incident is an OCR enforcement action, and no fines have been announced.
Updated Aug 14, 20265 min read
Data Breach
Five small healthcare organizations spanning primary care, oral surgery, vision care, and insurance benefits have newly disclosed patient data breaches under the HIPAA Breach Notification Rule. Here is what compliance officers need to know.
Updated Aug 12, 20266 min read
Data Breach
Ohio-based healthcare software provider Unlimited Technology Systems disclosed an unauthorized intrusion at its commercial datacenter that may have exposed sensitive data for roughly 3.8 million individuals, making it the largest healthcare breach reported to HHS so far in 2026.
Updated Aug 8, 20268 min read
Data Breach
Amgen disclosed in a Form 8-K that attackers exfiltrated patient PHI from cloud environments managed by outside vendors, not from Amgen's own systems. The breach triggers HIPAA's 60-day notification clock and SEC dual-reporting obligations simultaneously.
Updated Aug 2, 20266 min read
Data Breach
Four healthcare facilities have disclosed new patient data breaches, including Wildwood Surgical Center, which took over a year to complete its post-incident data review. Compliance officers should note the notification timeline implications.
Updated Jul 27, 20267 min read
Data Breach
Threat intelligence tracker BreachSense logged a ransomware claim by 'TheGentlemen' against Advantage Home Health Care on July 20, 2026. Here is what compliance officers and home health administrators need to know now.
Updated Jul 21, 20265 min read
Data Breach
U.K.-based healthcare billing software maker Craneware disclosed that hackers stole a significant volume of customer, employee, and partner data from its systems. Here is what compliance officers need to know now.
Updated Jul 21, 20266 min read
Data Breach
The Qilin ransomware group listed Hillebrand Home Health on its dark web leak site on July 14, 2026. Here is what compliance officers and home health administrators need to know right now.
Updated Jul 15, 20265 min read
Data Breach
A Minnesota hospital system notified patients more than 14 months after an unauthorized party accessed its network, exposing Social Security numbers, medical records, and financial data. Here is what compliance teams need to know.
Updated Jul 14, 20266 min read
Data Breach
Family Health Centers of Southern Indiana disclosed a January 2026 network intrusion that exposed patient names, dates of birth, Social Security numbers, medical information, and health insurance data. The five-month gap between detection and public disclosure raises serious questions about HIPAA breach notification compliance.
Updated Jul 7, 20265 min read
Data Breach
The Texas Hearing Institute in Houston notified at least 29,498 individuals after the Interlock ransomware group claimed a March 2026 attack exfiltrated 540 GB of data including Social Security numbers, financial records, and medical information.
Updated Jul 7, 20265 min read
Data Breach
Wisconsin DHS reported a HIPAA breach to OCR after benefit increase letters for 8,157 Medicaid SSI recipients were mailed to outdated addresses. Learn what this means for HIPAA breach notification obligations at government-run health programs.
Updated Jul 7, 20265 min read
Data Breach
ShinyHunters claimed responsibility for a June 2026 breach of One Medical Seniors legacy systems, threatening to expose a reported 8.8 terabytes of archived patient records. Here is what compliance officers need to know about HIPAA obligations that survive acquisitions.
Updated Jun 28, 20267 min read
Data Breach
OpenLoop Health, a white-label telehealth infrastructure vendor and business associate to numerous digital health companies, disclosed a January 2026 breach in which an unauthorized party removed data from its systems. Here is what covered entities and their compliance teams need to know.
Updated Jun 25, 20268 min read
Data Breach
A January 2026 phishing attack on AI utilization management vendor Xsolis exposed 1.4 million patient records across seven hospital systems. The breach also raises a serious HIPAA notification timing question: Xsolis reportedly waited 135 days before notifying HHS, well beyond the 60-day rule for business associates.
Updated Jun 24, 20267 min read
Data Breach
Kettering Health declined to pay the Interlock ransomware group. The attackers leaked the stolen data, exposing roughly 1.7 million people, including passports and plaintext credentials. Why refusing to pay does not change your HIPAA obligations, and what the breach reveals.
Updated Jun 18, 20267 min read
Data Breach
A ransomware attack on Conduent, a business process vendor serving health plans and government programs, started as a 4-million-person breach and grew into one of the largest in U.S. history. What it means for every health plan and covered entity that relies on a vendor.
Updated Jun 12, 20267 min read
Data Breach
A third-party vendor breach at NYC Health + Hospitals exposed roughly 1.8 million records from late November 2025 through February 2026, including biometric data such as fingerprints and palm prints. The Senate HELP Committee is now pressing the health system for answers.
Updated Jun 9, 20266 min read
Data Breach
NYC Health + Hospitals, Erie Family Health, and other large breaches recently posted to the HHS 'Wall of Shame' share one root cause: a third-party vendor. What the supply-chain breach pattern means for your practice, and what to do about it.
Updated Jun 9, 20267 min read
Data Breach
A complete guide to HIPAA breach response — from the moment of discovery through notification to HHS, individuals, and media. Includes the four-factor risk assessment, deadlines, and role-specific responsibilities.
Updated May 11, 202612 min read
Data Breach
When a breach happens, the clock starts immediately. A plain-English guide to who you must notify, the 60-day deadline, and the four-factor risk assessment, with CFR citations.
Updated May 11, 202610 min read
Data Breach
What to do in the first 60 days after a breach: assess, document, notify individuals and HHS, and avoid the mistakes that turn a breach into a penalty.
Updated May 11, 20261 min read