Data Breaches Reported by Sunshine Health; Health Payment Systems

Posted by Steve Alder

A vishing attack on Sunshine Health, a Florida-based Medicaid and health insurance agency, involved the theft of the PHI of more than 41,000 individuals. Health Payment Systems, a Wisconsin healthcare billing company, has experienced an email security incident affecting more than 8,000 patients.

Sunshine Health

Sunshine Health, a Broward County, Florida-based Medicaid and health insurance agency, has recently discovered a vishing incident involving the impermissible disclosure of the protected health information of 41,569 individuals.

Vishing, or voice phishing, takes place over the phone and involves tricking an individual into providing the attacker with access to their device or sensitive information. In this case, an employee was tricked into sharing a limited number of health plan files by a caller pretending to be a trusted individual. The incident occurred on May 6, 2026, and was identified the same day. An investigation was launched, and the shared files were reviewed and were found to include names, dates of birth, medical information/histories, and health plan coverage information.

Sunshine Health said it has not found any evidence to suggest that the disclosed information has been misused at this time; however, to protect against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Additional training has been provided to the workforce to raise awareness of the techniques that threat actors may use to gain access to internal systems and sensitive data.

Health Payment Systems

Health Payment Systems, Inc., a Wisconsin-based healthcare technology and billing software company, has notified the HHS’ Office for Civil Rights about a breach of the protected health information of 9,380 individuals.

On or around June 27, 2025, the company identified suspicious activity within its email environment. Immediate action was taken to secure the accounts and prevent further unauthorized access, and an investigation was launched to determine the nature and scope of the incident. Assisted by third-party cybersecurity specialists, Health Payment Systems confirmed that certain employee email accounts had been accessed by an unauthorized third party between June 24, 2025, and June 27, 2025, and certain emails were copied.

It has taken more than a year to investigate the incident and review the affected data. The HHS’ Office for Civil Rights was informed about the data breach on July 10, 2026, and notification letters are now being mailed to the affected individuals. Data exposed in the incident included names, addresses, birth dates, IDs, subscription IDs, and subscriber person IDs. For certain individuals, medical information, health insurance information, and Social Security numbers were also involved.

The affected individuals have been offered complimentary credit monitoring and identity theft protection services, and have been advised to monitor their explanation of benefits statements and account statements for signs of data misuse. Health Payment Systems said it has strengthened its security policies and has implemented additional cybersecurity measures to prevent similar incidents in the future.

The post Data Breaches Reported by Sunshine Health; Health Payment Systems appeared first on The HIPAA Journal.

California Child Care Company Discovers 9-Year Employee Data Leak

Posted by Steve Alder

A data breach has recently been announced by Child Care Resource Center that shows how even well-intentioned employee practices can result in the exposure of sensitive data. Child Care Resource Center is a California-based non-profit organization, and while it does not appear to be a HIPAA-covered entity, similar data breaches have occurred at entities subject to the HIPAA Rules.

Child Care Resource Center recently learned that one of its employees had been forwarding internal files containing personal data to an external email account. While sending emails containing internal data outside the organization could indicate data theft, in this case, Child Care Resource Center was satisfied that the files were being emailed in an effort to fulfil tasks associated with the employee’s role.

The employee had been emailing data to the external email account for many years before their actions were discovered. The investigation determined that the first instance occurred on October 4, 2016, and continued until October 15, 2025. It took until June 3, 2026, to complete the investigation and review the data involved. The affected individuals are now being notified and have been offered complimentary credit monitoring and identity theft protection services.

The breach notification letter sent to the California Attorney General does not state the exact types of data involved, nor the number of affected individuals; however, considering the practice spanned 9 years, it could be an extensive data breach. When files are forwarded to an external email account, the company loses control of the data and is unable to protect the information against unauthorized access.

In this case, the company found no evidence to suggest unauthorized data access, nor that any information had been misused. Since unauthorized data access cannot be ruled out in these circumstances, breach notifications are required. Child Care Resource Center said it has implemented additional safeguards to prevent similar incidents in the future.

Healthcare organizations can reduce the risk of incidents such as this by providing regular security awareness and HIPAA training, emphasizing the risks associated with emailing or otherwise copying data to complete work duties out of the office. Technical security measures should be configured to either block the emailing of internal data to external email accounts or, if not practical, to ensure that email security solutions are configured to flag anomalous behavior and closely monitor alerts for potential data security incidents.

The post California Child Care Company Discovers 9-Year Employee Data Leak appeared first on The HIPAA Journal.

Data Breaches Announced by Loma Linda University Health & UCLA Health

Posted by Steve Alder

Data security incidents have recently been announced by Loma Linda University Health and UCLA Health.

Loma Linda University Health

Loma Linda University Health has recently announced a data breach involving an external AI platform. The incident involved patient information from an Institutional Review Board-approved research study. During the course of the study, A dataset including limited patient information was inadvertently uploaded to an AI platform.

When the incident was identified, an investigation was launched to determine the extent of data exposure. The investigation determined that the dataset included medical record numbers, dates of birth, and limited clinical information related to orthopedic care.  The breach did not include complete treatment records, nor Social Security numbers, financial information, or insurance information.

The academic medical center said it takes the privacy and security of patient information seriously and is reviewing its policies, procedures, and workforce training on the use of external technologies such as AI platforms. The number of affected individuals has yet to be publicly disclosed.

UCLA Health

UCLA Health is notifying an unspecified number of patients about an improper disclosure of some of their personal and protected health information. According to the breach notice provided to the California Attorney General, UCLA Health determined on July 2, 2026, that patient information was accessed and disclosed to an outside healthcare provider in a manner inconsistent with its HIPAA policies.

The notice indicates that the disclosures occurred between December 27, 2024, and April 21, 2026. The investigation confirmed that the information involved was limited to names, dates of birth, health insurance information, and clinical information, such as referral orders. For a limited number of individuals, the last four digits of their Social Security numbers were also included.

UCLA Health said it has implemented additional measures to prevent similar breaches in the future, including enhanced system controls and increased monitoring. UCLA Health said it is unaware of any actual or attempted misuse of patient data as a result of the incident.

The post Data Breaches Announced by Loma Linda University Health & UCLA Health appeared first on The HIPAA Journal.