Cognitive Health Technologies Data Breach Affects 49,500 Individuals – The HIPAA Journal
Cognitive Health Technologies Data Breach Affects 49,500 Individuals The HIPAA Journal
Cognitive Health Technologies Data Breach Affects 49,500 Individuals
Data breaches have been announced by Cognitive Health Technologies in New York, City Ambulance Service in Texas, Baraga County Memorial Hospital in Michigan, The Speech Clinic in Georgia, and Innovative Alternatives in Texas.
Cognitive Health Technologies, New York
Cognitive Health Technologies LLC, a New York-based healthcare technology and IT consulting company, has disclosed a data security incident involving the protected health information of 49,467 individuals. According to its substitute data breach notice, suspicious network activity was identified on April 27, 2026. A forensic investigation was initiated to determine the nature and scope of the activity, which confirmed that its network had been accessed by an unauthorized third party between February 5, 2026, and April 28, 2026. During that time, there was unauthorized access and acquisition of files and folders containing protected health information.
The data review confirmed that the information compromised in the incident included names, dates of birth, health insurance information, medical histories, and treatment information. While patient data was compromised in the incident, no misuse of that information has been identified. Cognitive Health Technologies said it has reviewed its security policies and has implemented additional measures to protect against similar incidents in the future.
Viking Enterprises (City Ambulance Service), Texas
Viking Enterprises, doing business as City Ambulance Service in Spring, Texas, has notified the HHS Office for Civil Rights about a hacking incident affecting 14,324 individuals. The breach was reported to OCR on August 31, 2026, as an email-related incident. Little information has been released about the incident, although based on the report submitted to the Texas Attorney General, the compromised data includes names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The Qilin ransomware and data theft/extortion group claimed responsibility for the attack and maintains that sensitive data was stolen. It is unclear if ransomware was used in the attack. The July 19, 2026, listing on its dark web data leak site states that 14 GB of data was exfiltrated, and the stolen data has been published. The HIPAA Journal has not downloaded any of the data, so it cannot verify the claim; however, the screenshots uploaded as proof of compromise include some patient data.
Baraga County Memorial Hospital, Michigan
Baraga County Memorial Hospital in L’Anse, Michigan, has reported a data breach to the HHS’ Office for Civil Rights that involved unauthorized access to systems containing the protected health information of patients. At the time of publication, the number of affected individuals has yet to be determined. The breach has been reported using a placeholder figure of at least 501 affected individuals.
The hospital has not yet disclosed details of the incident or the information involved, other than the report to OCR that states this was a hacking/IT incident. A cybercriminal group claimed responsibility for the incident on July 4, 2026. The Wallstreet ransomware group added Baraga County Memorial Hospital to its dark web data leak site and claims to have exfiltrated data in the attack. The group leaked the stolen data when the ransom was not paid.
Innovative Alternatives, Texas
Innovative Alternatives, Inc., a Houston, Texas-based nonprofit mental health and counselling service provider, has disclosed a data security incident involving the personal and protected health information of approximately 1,500 current and former clients, employees, and donors. On August 2, 2026, Innovative Alternatives learned that a criminal cyber actor had accessed its network and used ransomware to encrypt files. Third-party cybersecurity and digital forensics experts were engaged to investigate the incident, and it was confirmed that data was accessed and may have been acquired. The electronic medical record system was not involved.
The data review confirmed that the compromised information included names, contact information, clinical counselling notes, and, for employees, contact and employment information. Innovative Alternatives has changed all system and user passwords, conducted additional security scans, and worked with third-party cybersecurity experts to strengthen its security measures to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on October 2, 2026.
The Speech Clinic, Georgia
The Speech Clinic, a Waycross, Georgia-based speech-language pathology, occupational therapy, and physical therapy service provider, has experienced a data security incident. On August 10, 2026, the practice began experiencing difficulties accessing a computer at its Waycross location. The forensic investigation confirmed on August 17, 2026, that the computer had been remotely accessed by an unauthorized third party, as well as an older server containing pre-2017 patient records of 2,168 patients.
The forensic investigation could not confirm whether patient data was accessed, but unauthorized access could not be ruled out. For some patients, only their name was exposed, while others had a combination of name, date of birth, Social Security number, diagnosis, and other medical information.
The post Cognitive Health Technologies Data Breach Affects 49,500 Individuals appeared first on The HIPAA Journal.
UNM cyberattack diverts ambulances, disrupts care and raises HIPAA concerns – Acronis
The Hidden HIPAA Risks of Using Personal Cell Phones for Patient Communication – Healthcare IT Today
The Hidden HIPAA Risks of Using Personal Cell Phones for Patient Communication Healthcare IT Today
41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident – The HIPAA Journal
41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident The HIPAA Journal
41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident
Data breaches have been announced by the Connecticut Department of Social Services, Public Partnerships LLC, Hattiesburg Eye Clinic, and the Eye Care Center of Snohomish.
Connecticut Department of Social Services
The Connecticut Department of Social Services (DSS) has reported a data breach involving the protected health information of 41,000 individuals. The incident involved claims and payment information related to the Connecticut Medicaid (HUSKY) program, which was exposed after an unauthorized user gained access to a Connecticut Medicaid provider reimbursement account. DSS was informed about the data breach by its fiscal agent and account administrator, Gainwell Technologies, on June 25, 2026. The investigation determined that the unauthorized access was most likely financially motivated, rather than to obtain patient data; however, data theft could not be ruled out.
The provider portal has been secured, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Electronic medical records, financial information, and Social Security numbers were not involved. The breach involved a combination of names, identification numbers associated with Medicare claims or provider payment accounts, dates of service, payment information, information about the services received, amounts paid, and information related to non-Medicaid health insurance.
This is the second such incident to be announced this year. An earlier breach in March 2026 affected approximately 22,500 individuals and involved unauthorized access to the HUSKY system using the compromised credentials of a Hartford Healthcare employee.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Public Partnerships LLC, New York
A data breach we had previously missed was reported by Public Partnerships LLC in early August that involved the attempted sale of the protected health information of 12,018 individuals. Public Partnerships is the single fiscal intermediary (FI) for the New York Consumer Directed Personal Assistance Program (CDPAP). CDPAP is a state Medicaid program that allows individuals who require home care to choose, hire, train, and manage their own caregivers.
In June 2026, Public Partnerships learned that a former facilitator had attempted to sell consumer data to another New York CDPAP facilitator. The former facilitator had been terminated by Public Partnerships in March 2026 for (unspecified) non-compliance with the program integrity requirements. The facilitator who was approached and offered the data refused and reported the incident to Public Partnerships.
Before Public Partnerships became the single FI for CDPAP, the state used hundreds of localized independent organizations. These legacy FIs became network facilitators or subcontractors under Public Partnerships under the single statewide contract with Public Partnerships. When it learned of the alleged sale, the former FI was contacted, informed about the allegation, and was told that offering to sell CDPAP data is unlawful and a breach of its ongoing contractual obligations. The former FI was instructed to delete all CDPAP data in its possession. Public Partnerships also notified all remaining facilitators of their contractual obligations and that the sale and purchase of CDPAP data is unlawful.
The case has been reported to the HHS Office for Civil Rights and the HHS Office of Inspector General, and all potentially impacted individuals have been notified by mail. The impacted data included names, addresses, dates of birth, Medicaid ID numbers, PPL ID numbers, and information relating to enrollment in New York Medicaid. While the sale appears not to have gone ahead, and there have been no other known cases, the affected individuals have been offered complimentary identity protection and credit monitoring services.
Hattiesburg Eye Clinic, P.A., Mississippi
Hattiesburg Eye Clinic, P.A. in Mississippi has reported a data security incident that potentially involved unauthorized access to the protected health information of 6,137 individuals. A network disruption was experienced on August 18, 2026, and third-party cybersecurity experts were engaged to investigate and determine the nature and scope of the activity. The review of the incident concluded on September 16, 2026, and confirmed that patient data had been exposed and may have been acquired. The affected data varied from individual to individual and may have included first and last names, phone numbers, Social Security numbers, and medical diagnoses/conditions.
Additional technical safeguards have been implemented to prevent similar incidents in the future, and notification letters have been mailed to all potentially affected individuals. A ransomware and data theft/extortion group called The Gentlemen claimed responsibility for the incident and maintains that patient data was stolen.
Anup K. Deol, OD PS (Eye Care Center of Snohomish), Washington
Anup K. Deol, OD PS, doing business as Eye Care Center of Snohomish in Washington, has identified unauthorized access to parts of its network containing the protected health information of 3,059 patients. The unauthorized access was identified on August 12, 2026, and third-party cybersecurity experts were engaged to investigate the activity. The investigation confirmed that an unauthorized third party gained access to limited files on its network on or around July 28, 2026.
The review of the affected files was completed on September 28, 2026. The data involved varied from individual to individual and may have included names, addresses, birth dates, and medical information, which may have included lab results, diagnoses, medications, and treatment information. The incident was reported to law enforcement, and additional safeguards have been implemented to prevent similar incidents in the future.
The post 41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident appeared first on The HIPAA Journal.
Washington wants to punish the company that caught people stealing your health records – Washington Examiner
HIPAA Compliant Cloud Storage Cost: 13 Steps, 90 Min [2026] – tech-insider.org
HIPAA Compliant Cloud Storage Cost: 13 Steps, 90 Min [2026] tech-insider.org
Azure Backup HIPAA Vault: 13 Steps, 90 Min [2026] – tech-insider.org
Azure Backup HIPAA Vault: 13 Steps, 90 Min [2026] tech-insider.org