Data Breaches Announced by Neinstein Plastic Surgery; Atlantic Brain and Spine

Posted by Steve Alder

Neinstein Plastic Surgery in New York and Atlantic Brain and Spine in North Carolina have announced security incidents that exposed patient information.

Neinstein Plastic Surgery, New York

Neinstein Plastic Surgery in New York City has identified unauthorized access to an email account that contained sensitive patient information. Unauthorized activity was identified in the email account on December 2, 2025. The account was secured, and an investigation was initiated to determine the nature and scope of the activity. The investigation confirmed that the account had been accessed by an unauthorized individual between November 12, 2025, and November 20, 2025, and that this was a financially motivated attack rather than an attempt to obtain patient information; however, patient information may have been obtained in the incident.

The account was reviewed and on February 20, 2026, Neinstein Plastic Surgery confirmed that emails and documents in the account contained information such as names, contact information, dates of birth, driver’s license or passport numbers, Social Security numbers, credit card or financial account information, health insurance information, and clinical information, which may have included healthcare provider names, diagnoses, and treatment information. The types of information involved vary from individual to individual.

The incident was reported to law enforcement, additional technical safeguards have been implemented to improve email security, and further employee training has been provided. While there has been no known misuse of patient information, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The data breach has been reported to the appropriate authorities, although it is currently unclear how many individuals have been affected.

Atlantic Brain and Spine, North Carolina

Wilmington, North Carolina-based Atlantic Brain and Spine has disclosed a January 2026 cybersecurity incident. Suspicious activity was identified within its computer network on January 26, 2026. Third-party specialists were engaged to investigate the incident and confirmed that certain patient data had been accessed by an unauthorized third party.

The exposed data is still being reviewed; however, Atlantic Brain and Spine determined that the impacted data includes names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers, financial account information, treatment/diagnosis information, prescription/medication information, dates of service, provider names, medical record numbers, patient account numbers, Medicare/Medicaid ID numbers, health insurance information, and/or medical billing/claims information. The types of data involved vary from individual to individual.

Atlantic Brain & Spine is working with third-party cybersecurity specialists to implement additional measures to prevent similar incidents in the future and is reviewing its policies and procedures related to data privacy and security.  Since the review is ongoing, it is unclear how many individuals have been affected at this moment in time.

The post Data Breaches Announced by Neinstein Plastic Surgery; Atlantic Brain and Spine appeared first on The HIPAA Journal.

Settlement Agreed to Resolve Class Action Data Breach Litigation Against Concord Orthopaedics

Posted by Steve Alder

Concord Orthopaedics Professional Association, a New Hampshire-based provider of comprehensive orthopedic and rheumatology care, has settled a consolidated class action lawsuit stemming from a November 2024 cybersecurity incident involving unauthorized access to the personal and protected health information of 72,815 individuals.

Concord Orthopaedics detected an intrusion on November 21, 2024. Hackers had gained access to its computer network, where names, dates of birth, Social Security numbers, appointment information, health insurance information, and driver’s license/state identification numbers were stored. The affected individuals started to be notified about the incident on March 25, 2025.

The first class action lawsuit was filed by plaintiff Kattie Montambeault on April 1, 2025, in the Merrimack County Superior Court for the State of New Hampshire. A further four class action complaints were filed in response to the data breach, which were consolidated into a single action – Montambeault, et al. v. Concord Orthopaedics Professional Association – in the Superior Court of Hillsborough County, New Hampshire. The consolidated class action complaint names 12 individuals as class representatives.

The lawsuit alleged that Concord Orthopaedics failed to implement reasonable and appropriate cybersecurity measures to protect sensitive data stored on its network, and that, as a result of that failure, the plaintiffs’ and class members’ personal and protected health information was accessed by hackers.

Concord Orthopaedics agreed to a settlement to resolve all claims asserted in the lawsuit with no admission of wrongdoing, fault, or liability. Class counsel and the class representatives believe that the settlement is fair, and the settlement has received preliminary approval from the court. The settlement provides multiple benefits for the class members. All class members are entitled to a one-year membership to a medical data monitoring service, and may also submit a claim for the following benefits:

  • Reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $3,000 per class member
  • Reimbursement of lost time of up to 4 hours at $25 per hour (maximum of $100)

In addition to or instead of a claim for reimbursement of out-of-pocket losses, class members may submit a claim for a one-time cash payment, which is estimated to be $50, but may be higher or lower depending on the number of valid claims received. Individuals submitting a claim for reimbursement of lost time are not eligible to claim the one-time cash payment.

The deadline for objection to the settlement and exclusion is May 26, 2026. The deadline for submitting a claim is July 8, 2026, and the final fairness hearing has been scheduled for June 23, 2026

The post Settlement Agreed to Resolve Class Action Data Breach Litigation Against Concord Orthopaedics appeared first on The HIPAA Journal.

OCR Releases Video on HIPAA Security Rule Risk Management Requirements

Posted by Steve Alder

Earlier this year, Paula M. Stannard, Director of the Department of Health and Human Services (HHS) Office for Civil Rights (OCR), provided an update on OCR’s enforcement priorities in 2026 and confirmed that OCR’s risk analysis enforcement initiative will continue, and that it will evolve to also target noncompliance with the risk management requirement of the HIPAA Security Rule.

The risk analysis provision – § 164.308(a)(1)(ii)(A) – requires HIPAA-regulated entities to “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by the covered entity or business associate.” OCR has previously issued guidance on the risk analysis requirement, and has issued a risk assessment tool for small- and medium-sized entities to guide them through the process of comprehensively assessing risks to ePHI.

A risk analysis is one of four required implementation specifications under the security management process of the administrative safeguards, the others being risk management, sanction policy, and information system activity review. The risk management implementation specification requires HIPAA-regulated entities to “Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with [the Security Standards: General Rules] § 164.306(a).”

Risk management is an essential component of HIPAA Security Rule compliance and cybersecurity preparedness in general. Risk management is a critical step toward defending against cyberattacks, which is why OCR has expanded its enforcement initiative to cover risk management. When OCR investigates a data breach or complaint, the regulated entity will need to demonstrate that it has conducted a comprehensive and accurate risk analysis and has acted on the findings of that analysis to reduce risks and vulnerabilities to a reasonable and appropriate level.

To help HIPAA-regulated entities manage risks and vulnerabilities, OCR has recorded a risk management video. In the video, Nicholas Heesters, OCR’s Senior Advisor for Cybersecurity, explains the HIPAA risk management requirements and provides examples of potential risk management violations identified during OCR’s investigations of data breaches. In December 2025, OCR requested questions from HIPAA-regulated entities on risk management, and has provided answers to a selection of those questions in the video. The video also shares important resources to help HIPAA-regulated entities comply with this important HIPAA Security Rule requirement. You can view the video on OCR’s YouTube channel.

The post OCR Releases Video on HIPAA Security Rule Risk Management Requirements appeared first on The HIPAA Journal.

New Jersey Long Term Care Pharmacy Data Breach Affects 133,800 Patients

Posted by Steve Alder

The New Jersey long-term care pharmacy Innovative Pharmacy Packaging Corp (IPPC Inc), and the affiliated entities IPPC of New York LLC, and Innovative Pharmacy LLC have confirmed in a breach report to the HHS’ Office for Civil Rights (OCR) that the protected health information of 133,862 patients has been exposed and potentially obtained in a recent security incident.

IPPC identified anomalous network activity in September 2025 and launched an investigation to determine the nature and scope of the activity. The forensic investigation confirmed that an unauthorized third party accessed its network between September 18, 2025, and September 19, 2025, and exfiltrated files from its network. IPPC conducted a review of the affected files, which concluded on February 9, 2026, when it was confirmed that they contained a range of personal and protected health information.

The types of information involved vary from individuals to individual and may include names in combination with dates of birth, driver’s license/ government-issued identification numbers, Medicare/Medicaid identification numbers, individual taxpayer identification numbers, passport numbers, medical record number/patient account numbers, diagnosis and treatment information, procedure information, prescription information, health insurance information, payment card information, financial account information, billing and claims information, treating/referring provider names, and admission and discharge dates.

IPPC started sending notification letters to the affected individuals on April 1, 2026, and has offered the affected individuals 24 months of complimentary credit monitoring and identity theft protection services. Individuals receiving a notification letter should ensure that they sign up for those services as soon as possible to protect themselves against misuse of their data, since data was copied in the incident. IPPC said it has implemented additional security measures to prevent similar incidents in the future and is revising its policies and procedures related to data privacy and security.

The post New Jersey Long Term Care Pharmacy Data Breach Affects 133,800 Patients appeared first on The HIPAA Journal.