Data breaches have recently been announced by Methodist Homes of Alabama & Northwest Florida, Rockhill Women’s Care, and Sierra Vista Hospital & Clinics.

Methodist Homes of Alabama & Northwest Florida

Methodist Homes of Alabama & Northwest Florida, a provider of affordable homes, senior living, and healthcare services, disclosed a data breach on October 8, 2025, involving unauthorized access to the personal and protected health information of almost 26,000 residents, employees, and other individuals. The breach occurred almost one year previously, having first been detected on October 14, 2024.

An investigation was launched to determine the cause of suspicious network activity, which confirmed that an unauthorized actor had access to its network between October 2, 2024, and October 14, 2024. During that time, sensitive data may have been accessed or acquired. All exposed files were reviewed, and that process was completed on September 2, 2025. Notification letters have now been mailed to all individuals with valid contact information, and regulators have been notified, including the HHS’ Office for Civil Rights.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal; however, the Maine Attorney General was informed that 25,579 individuals have been affected in total. The information involved varies from individual to individual and may include names in combination with one or more of the following: Social Security number, driver license or state ID number, health insurance number, and clinical information, including medical record number, medical history, diagnosis and treatment information, patient number, Medicaid/Medicaid number, date of discharge, and date of birth.

Individuals who were neither patient nor resident had their first and last name exposed, plus one or more of the following: Social Security number, driver’s license number, state ID, health insurance number, and medical history information. Credit monitoring services have been offered free of charge to individuals whose Social Security numbers were involved.

Rockhill Women’s Care

The OB-GYN medical practice, Rockhill Women’s Care, which has locations in Overland Park, Kansas, and Lee’s Summit, Missouri, has started notifying patients about a security incident that affected its IT systems and exposed patient information. Suspicious network activity was identified on or around February 26, 2025, and third-party cybersecurity experts were engaged to investigate the activity and assist with remediation. The substitute breach notice does not state when its network was first accessed or for how long hackers had access to the network.

The file review concluded on August 13, 2025, when it was confirmed that the information compromised in the incident included names, addresses, dates of birth, Social Security numbers, treatment information, and, for some patients, also health insurance information. The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

Sierra Vista Hospital & Clinics

Sierra Vista Hospital & Clinics in Truth or Consequences, New Mexico, has identified unauthorized access to its computer network and the exposure of patient information. The unauthorized access was identified on January 29, 2025, and working with third-party digital forensics specialists, it was determined that a threat actor had access to its network from January 14, 2025, to January 31, 2025.

A comprehensive review was conducted to determine whether patient data had been exposed, and on August 13, 2025, it was confirmed that sensitive patient data may have been accessed or acquired, including first and last names, addresses, state identification numbers/driver’s license numbers, medical information, and health insurance information. Network security has been strengthened, and additional cybersecurity measures have been implemented to prevent similar breaches in the future. Those measures include strengthened email filtering and malware monitoring, and additional cybersecurity awareness training is being provided to the workforce.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected. The Texas Attorney General was notified that 481 Texas residents were affected.

The post Almost 26,000 Individuals Affected by Data Breach at Methodist Homes of Alabama & Northwest Florida appeared first on The HIPAA Journal.

A data breach at the Fort Wayne Medical Education Program has affected almost 30,000 individuals. Data breaches have also been announced by Space Coast Vascular in Florida and Partners in Pediatrics in Colorado.

Fort Wayne Medical Education Program

Fort Wayne Medical Education Program, a family medicine residency in Northeastern Indiana, has recently announced a security incident that potentially involved unauthorized access to the personal and protected health information of up to 29,485 individuals, including patients, employees, and employees’ dependents.

Suspicious activity was identified within its computer network on December 17, 2024, and after securing its systems, the activity was investigated. The forensic investigation confirmed that an unauthorized actor had access to its computer network from December 12, 2024, to December 17, 2024, during which time files containing sensitive data may have been viewed or acquired. The file review was completed on September 9, 2025, when it was confirmed that personal and protected health information had been exposed.

The types of data involved vary from individual to individual. For employees and their dependents, the exposed data included first and last names, in combination with a Social Security number, driver’s license number, state ID number, or passport number. For patients, the exposed information includes names in combination with some or all of the following: Social Security number, government ID number such as driver’s license or passport number, date of birth, medical information, health insurance information, and medical billing information, which may have included bank account number and payment or credit card number (but not CVC). Notification letters were mailed to the affected individuals on October 2, 2025, and complimentary credit monitoring and identity protection services have been offered to individuals whose Social Security number was involved.

Space Coast Vascular

Space Coast Vascular, a vascular and venous health diagnostic laboratory and treatment center in Melbourne, Florida, has announced that it was the subject of a criminal cyberattack on or around January 13, 2025, that impacted its computer systems. Assisted by third-party cybersecurity experts, Space Coast Vascular learned on August 7, 2025, that patients’ protected health information had been exposed and may have been viewed or acquired by the threat actor.

The types of data involved vary from individual to individual and may include name, date of birth, Social Security number, driver’s license/state ID number, medical treatment information, health insurance information, and/or financial account information. At the time of issuing notifications, Space Coast Vascular was unaware of any misuse of patient data as a result of the incident.

The affected individuals are now being notified by mail, and at least 12 months of complimentary credit monitoring and related services are being offered.  Space Coast Vascular has also confirmed that a series of cybersecurity improvements have been made to reduce the risk of similar incidents in the future. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Partners in Pediatrics

Partners in Pediatrics, an integrative pediatric healthcare practice with offices in Denver and Englewood in Colorado, has recently notified patients about a recent email account breach. Suspicious activity was identified in an employee’s email account on March 5, 2025. The email account was secured, and digital forensics experts were engaged to investigate the activity. They determined that the threat actor had access to emails containing patient information; however, no other systems were affected. The emails were reviewed, and that process was completed on September 23, 2025. Information potentially compromised in the incident includes names, dates of birth, Social Security numbers, driver’s license numbers, clinical information, treatment information, lab test results, prescription information, provider information, and health insurance information.

Data privacy and security policies and procedures have been reviewed, and security measures have been enhanced to prevent similar incidents in the future. On October 3, 2025, individual notification letters started to be mailed to the affected individuals. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Fort Wayne Medical Education Program Data Breach Affects Almost 30,000 Individuals appeared first on The HIPAA Journal.