Data breaches have been announced by New Horizons Behavioral Health in Georgia, CWA Local 1180 in New York, Coastal Carolina Health Care in North Carolina, West Texas Health, and Nephrology Associates Medical Group and Stockton Cardiology Medical Group in California.

New Horizons Behavioral Health, Georgia

The Columbus, Georgia-based community mental healthcare provider New Horizons Behavioral Health has announced a January 2026 security incident. Suspicious network activity was identified on January 18, 2026, and the forensic investigation confirmed unauthorized access to its network between January 15, 2026, and January 18, 2026. Data review specialists have been engaged to determine which individuals have been affected, and while that process is ongoing, New Horizons Behavioral Health has confirmed that the data exposed in the incident includes names, addresses, birth dates, Social Security numbers, driver’s license numbers, financial account information, diagnosis information, treatment and prescription information, provider names, treatment locations, and health insurance information.

New Horizons Behavioral Health said the affected individuals will be offered complimentary credit monitoring and identity theft protection services, and will receive notifications when the data review is concluded. While not stated in the breach notice, the Devman threat group took credit for the attack. On December 1, 2025, Devman added New Horizons Behavioral Health to its data leak site with a threat to publish 236 GB of data allegedly stolen in the attack.

Stockton Cardiology Medical Group, California

Stockton Cardiology Medical Group, an independent physician practice serving the San Joaquin Valley area of California, has started notifying patients about a recent security incident. According to the breach notice provided to the California Attorney General, suspicious emails were identified that had been sent to its employees. Stockton Cardiology deleted the emails as part of its remediation efforts; however, on January 17, 2026, Stockton Cardiology learned that files containing patient information may have been accessed or acquired.

An investigation was launched to determine the scope of the breach, and the impacted files were found to contain personally identifiable information and protected health information, including patient names, mailing addresses, email addresses, and billing records that may contain limited medical information associated with services provided. The affected individuals have been offered complimentary credit monitoring services, and steps have been taken to improve security. They include shutting down an older remote access service used by staff members, implementing multifactor authentication for internal systems, resetting all passwords, and reviewing data retention policies to minimize the data stored on its systems.

Stockton Cardiology said it learned on February 17, 2026, that some of the stolen data had been published online. That was the date that the Genesis threat group claimed responsibility for the attack. Genesis said 645 GB of data was stolen in the attack, including personal and healthcare data.

Coastal Carolina Health Care, North Carolina

Coastal Carolina Health Care (CCHC), a provider of primary and specialty care services in Craven, Pamlico, and Carteret Counties in North Carolina, has recently notified the New Hampshire Attorney General about a data breach. Unauthorized network activity was first identified on March 25, 2025, and after securing its network and investigating the incident, the healthcare provider determined that there had been unauthorized network access between March 21, 2025, and March 27, 2025. A third-party vendor was engaged to review the affected data, and almost a year later, the types of data involved have been confirmed.

Coastal Carolina Health Care said it was determined on February 26, 2026, that names and Social Security numbers were compromised in the incident, and sufficient information was obtained to effectuate individual notifications.  The affected individuals have been offered complimentary credit monitoring and identity theft protection services. Coastal Carolina Health Care said additional security measures have been implemented to prevent similar incidents in the future.

West Texas Health

West Texas Health PLLC has notified 73,720 individuals about a recent data security incident that impacted Privia Medical Groups West Texas, LLC. On or around October 3, 2025, West Texas Health discovered a security incident. Assisted by external cybersecurity professionals, unauthorized access was confirmed between September 12, 2025, and October 3, 2025.  West Texas Health said that following an extensive forensic investigation and comprehensive document review, on February 6, 2026, it was confirmed that protected health information was acquired in the incident.

The types of data involved vary from individual to individual and may include names in combination with some or all of the following: first and last names, Social Security numbers, driver’s license/state-issued identification numbers, passports, military identifications, other unique government-issued identification numbers, financial account information, financial account numbers, payment card information, taxpayer identification numbers or IRS identity protection PINs, medical histories, medical diagnosis and treatment information, health insurance policy numbers, claims histories, other health insurance information, and usernames/email addresses with passwords and security questions and answers. West Texas Health said individuals whose Social Security numbers were exposed have been offered complimentary credit monitoring and identity theft protection services.

Nephrology Associates Medical Group, California

Nephrology Associates Medical Group in Riverside, California, has notified the California Attorney General about a May 2025 cybersecurity incident. Suspicious activity was identified within its email system on May 20, 2025. Assisted by third-party cybersecurity professionals, Nephrology Associates confirmed that an employee’s email account had been compromised. The account was reviewed, and on December 12, 2025, the review was completed, confirming that personal information was present in the account, including names, Social Security numbers, dates of birth, medical/health information, treatment/diagnostic information, health insurance information, billing/payment information, and credentialing information.

Nephrology Associates has strengthened password requirements, is now enforcing more frequent password changes, has reduced access permissions, and is storing older data offline. The breach has been reported to the HHS’ Office for Civil Rights; however, there is now a substantial delay in adding breach data to the public-facing section of its breach portal. At present, it is unclear how many individuals have been affected.

Communications Workers of America Local 1180 Security Benefits Fund, New York

Communications Workers of America Local 1180 Security Benefits Fund (CWA Local 1180) has notified regulators about a data breach involving unauthorized access and potential acquisition of the personal and protected health information of 18,550 individuals. In a notification to the Massachusetts Attorney General, CWA Local 1180 said the forensic investigation of the incident determined that its network was breached on December 24, 2025.

The investigation determined that names and Social Security numbers were potentially compromised in the incident, although no evidence has been found to indicate that there has been any misuse of the impacted data. As a precaution against data misuse, the affected individuals have been offered 24 months of complimentary credit monitoring and identity theft protection services. CWA Local 1180 said that it has taken steps to harden security to prevent similar incidents in the future.

The post Six New Healthcare Data Breaches Announced appeared first on The HIPAA Journal.

Data breaches have recently been reported by Vantage Plastic Surgery in New York City and Austin Plastic and Reconstructive Surgery in Texas.

Vantage Plastic Surgery, New York

Vantage Plastic Surgery, a plastic surgery practice in New York City, has recently disclosed a security incident involving unauthorized access to the protected health information of 4,600 current and former patients. The plastic surgery practice said it first learned about the cyberattack on January 15, 2026, and immediate action was taken to secure its computer environment. Third-party cybersecurity specialists were engaged to assist with the investigation, and on January 22, 2026, the practice confirmed that patient data had been exposed and may have been obtained by an unauthorized third party.

The file review determined that names, addresses, phone numbers, email addresses, dates of birth, and medical record information had been exposed in the incident. The practice announced the data breach on February 14, 2026, and is now notifying the affected patients. Complimentary credit monitoring and identity theft protection services have been offered to the affected individuals, and steps have been taken to bolster security to prevent similar incidents in the future.

Austin Plastic and Reconstructive Surgery, Texas

Austin Plastic and Reconstructive Surgery in Texas has notified patients about a security incident that involved unauthorized access to its network last summer. The incident was detected on or around July 1, 2025, and the forensic investigation confirmed unauthorized access to its network between June 30, 2025, and July 1, 2025.

Third-party cybersecurity professionals were engaged to investigate the incident, and the affected files were reviewed. On February 28, 2026, it was confirmed that files accessed or acquired in the incident contained names, addresses, dates of birth, financial account information, driver’s license numbers/state identification numbers, passport numbers, Social Security numbers, medical information, and health insurance information.

Notification letters were sent to the affected individuals on March 11, 2026, and at that time, no misuse of the affected data had been identified. Complimentary credit monitoring and identity theft protection services have been offered to individuals whose Social Security numbers were involved. The breach is not currently listed on the HHS Office for Civil Rights breach portal of the website of the Texas Attorney General, so it is currently unclear how many individuals have been affected.

The post Data Breaches Reported by New York & Texas Plastic Surgery Practices appeared first on The HIPAA Journal.

The HIPAA Journal reported on a data breach affecting patients of NYC Health + Hospitals Corporation in late March (see below), after the New York healthcare provider disclosed details of the breach. Hackers had access to its network for 11 weeks, with the investigation suggesting that initial access was gained via a security breach at one of its vendors. At the time of reporting, it was unclear how many individuals had been affected.

NYC Health + Hospitals is the largest public health system in the United States, and serves more than 1 million New Yorkers, mostly uninsured patients under state benefits programs such as Medicaid. The Department of Health and Human Services Office for Civil Rights (OCR) breach portal has been updated to show that the personal and protected health information of approximately 1.8 million current and former patients and employees was compromised in the incident, making this one of the largest healthcare data breaches to be announced so far this year.

The affected employees and patients have been offered complimentary credit monitoring and identity theft protection services for 24 months. Those services are being made available free of charge to any individual who was a workforce member for NYC Health + Hospitals or a patient of NYC Health + Hospitals at any point between 2020 and February 2, 2026.

March 25, 2026: NYC Health + Hospitals Discloses 11-week Network Compromise

On March 24, 2026, NYC Health + Hospitals Corporation announced that personally identifiable information (PII) and protected health information (PHI) were exposed in a data security incident. NYC Health + Hospitals identified suspicious activity within its computer network on February 2, 2026. Immediate action was taken to secure the affected systems, and an investigation was launched to determine the nature and scope of the unauthorized activity, with assistance provided by third-party cybersecurity specialists.

The investigation determined that an unauthorized third party first gained access to its network more than two months previously, on November 25, 2026, and retained access until February 11, 2026. The investigation into the incident is ongoing; however, NYC Health + Hospitals believes that initial access to its systems may have been gained in a security breach at one of its third-party vendors. The name of that vendor was not disclosed.

NYC Health + Hospitals determined that files were exfiltrated from its network, some of which contained PII and PHI. Over the past few weeks, NYC Health + Hospitals has been reviewing the impacted data to determine the types of information involved and the individuals affected by the incident. The delay in issuing notifications to the affected individuals was due to the time taken to review the affected data. There were no instructions from law enforcement to delay notifications.

Based on the results of the data review to date, the following types of data were compromised in the incident: names; medical information (medical record numbers, disability codes, diagnoses, medications, test results, images, treatment plans); health insurance information (plans/policies, insurance companies, member/group ID numbers, Medicaid-Medicare-government payor ID numbers), billing/claims information; biometric information (finerprints & palm prints); personal information (Social Security numbers, driver’s license numbers or other government-issued identification numbers, taxpayer identification numbers or IRS-issued identity protection numbers, precise geolocation data, credit or debit card numbers, financial account information or credentials, online account credentials). The information involved varies from individual to individual.

NYC Health + Hospitals said several steps have been taken to bolster security to prevent similar incidents in the future. They include enhanced detection rules for cybersecurity tools, password resets for compromised accounts, additional detection and protective technologies, and updates to remote access management policies. Credit monitoring and identity theft protection services have been offered to the affected employees and patients for 24 months.

This is the second large data breach to be reported by NYC Health + Hospitals so far this year. An earlier incident occurred around the same time as this hacking incident, and while it exposed the data of NYC Health + Hospitals patients, the breach occurred at one of its Care Management Agency Partners, NADAP. NADAP provides care coordination services to patients who received services under NYC Health + Hospitals’ Lead Health Home.

The data breach exposed the protected health information of 5,086 individuals. The incident occurred on or around November 26, 2025, and was identified by NADAP on January 10, 2026. NYC Health + Hospitals was notified about the data breach on January 2, 2026. Data compromised in the incident included patients’ names, dates of birth, addresses, Medicaid numbers, Social Security numbers, and clinical information related to their home-based health care provided by NADAP.

The post Up to 1.8 Million Individuals Affected by NYC Health + Hospitals Data Breach appeared first on The HIPAA Journal.

Evansville, Indiana-based Deaconess Health System has announced a data breach involving information shared with a third-party vendor, the MRO Corp-owned company MediCopy. Deaconess Health System is one of the largest health systems in the Illinois-Indiana-Kentucky tri-state area, and operates 18 hospitals in southwestern Indiana, western Kentucky, and southeastern Illinois. The data breach affects certain patients of two of its hospitals: Deaconess Henderson Hospital in Henderson, KY, and Deaconess Union County Hospital in Morganfield, KY.

Deaconess Health System contracted with MediCopy to handle release of information (ROI) requests. Deaconess Health System’s substitute breach notice explains that MediCopy informed the health system about the security incident on February 2, 2026. The investigation determined that an unauthorized actor accessed MediCopy-controlled/managed cloud-based file-sharing software on January 13, 2026, and downloaded files related to ROI requests. The security incident was limited to the cloud-based platform. There was no unauthorized access to any Deaconess Health System’s IT systems or electronic health record system. A spokesperson for MRO said neither the MRO platform nor MediCopy systems were compromised in the incident.

Deaconess Health System conducted a comprehensive review of the affected data and determined that the information compromised in the incident included names, dates of birth, dates of service, medical record numbers, Social Security numbers, health insurance information, and medical records related to the treatment received at Deaconess Health System hospitals.

Notification letters are being mailed to the affected individuals by Deaconess Health System, which is offering complimentary credit monitoring and identity theft protection services. Deaconess Health System has confirmed that additional measures have been implemented to further strengthen the security of its file-sharing platform and the information maintained on that platform.

The number of Deaconess Health System patients affected by the data breach has yet to be publicly disclosed. Deaconess Health System said it has reported the breach to the appropriate agencies,  but the breach is not yet shown on the HHS’ Office for Civil Rights breach portal. There has been a delay in adding data breaches to the OCR data breach portal. While there have been some additions of data breaches with reporting dates prior to February 26, 2026, the breach portal lists no new additions after that date (as of March 25, 2026).

The post Deaconess Health System Affected by Vendor Data Breach appeared first on The HIPAA Journal.

The sensitive data of more than 23,000 Florida Medicare members has been impermissibly shared with overseas companies, putting Medicare members’ sensitive health data at risk. The data was shared by Mirra Health, a provider of administrative services to health maintenance organizations (HMOs) in Florida.

Mirra Health had contracts with three HMOs in Florida: Secure Inc, Solis Health Plans Inc., and Ultimate Health Plans Inc. Under those contracts, Mirra Health agreed to provide certain administrative services, including member enrollment, claims adjudication and payment, utilization management, and grievance and appeals processing. Mirra Health engaged four unlicensed companies in India and the Philippines to perform claims processing and other functions and provided those companies with the necessary data to perform those functions.

While Mirra Health may choose to delegate certain functions to subcontractors, sensitive data was shared with unlicensed companies without the knowledge or prior approval of the HMOs or their enrollees. Under the terms of its contracts with the HMOs, prior authorization must be received before passing any data to offshore partners.

An investigation conducted by the Florida Office of Insurance Regulation determined that Mirra Health had engaged in business practices that pose an imminent threat to the public health, safety, and welfare of state residents. Mirra Health was found to have disclosed the sensitive data of 23,119 Florida Medicare Advantage enrollees to those unlicensed companies. The majority of the affected individuals participated in Chronic Condition Special Needs Plans (C-SNPs), Dual Eligible Special Needs Plans (D-SNPs), and Institutional Special Needs Plans (I-SNPs). When the Florida Office of Insurance Regulation requested that Mirra Health produce the contracts it had signed, it failed to produce all contracts with overseas companies, in violation of section 626.884 of the Florida Insurance Code.

This week, Florida Insurance Commissioner Michael Yaworsky suspended Mirra Health LLC’s certificate of authority. Yaworsky said the company demonstrated it is not competent or trustworthy, as it disclosed sensitive Medicare data to foreign entities that are beyond the regulatory reach of the Office of Insurance Regulation, depriving both the Office and the HMOs of the ability to protect vulnerable state residents.

The post Florida Insurance Commissioner Suspends Mirra Health for Medicare Data Transfers to Foreign Companies appeared first on The HIPAA Journal.

On March 24, 2026, The HIPAA Journal reported on a data breach at the telehealth platform provider Open Loop Health (see below). The data breach had been reported to regulators, but it can take weeks for the incident to be added to the HHS Office for Civil Rights breach portal and for the scale of the breach to become clear. While the data breach was reported to OCR on March 17, 2026, it has only recently been added to the breach portal. That listing shows that the protected health information of up to 716,000 individuals was compromised in the incident.

March 24, 2026: Telehealth Platform Provider OpenLoop Health Discloses Data Breach

A major data breach has been reported by the telehealth platform provider OpenLoop Health Inc. While the total number of affected individuals has yet to be publicly disclosed, it could well be one of the largest healthcare data breaches of the year to date. According to the breach notice provided to the California Attorney General, OpenLoop Health learned on January 7, 2026, that an unauthorized third party had gained access to some of its systems and copied files containing sensitive data. Third-party cybersecurity specialists were engaged to investigate and determine the nature and scope of the incident and ensure that its systems were secured and could no longer be accessed.

The forensic investigation confirmed that the unauthorized third party had access to its network from January 7, 2026, to January 8, 2026, and the files exfiltrated from its systems included information such as names, addresses, email addresses, dates of birth, and medical information. OpenLoop Health said Social Security numbers were not accessed or stolen. Steps have since been taken to harden security, and the affected individuals are being notified by mail. Complimentary credit monitoring and identity theft protection services have been offered to the affected individuals.

A threat actor with the moniker Stuckin2019 claimed responsibility for the incident in a hacking forum listing and claims to have obtained the information of 1.6 million patients. Threat actor claims may be exaggerated, the records may not all be unique, and in some cases, the claims are entirely fabricated. In this case, Stuckin2019 published samples of patient data as proof of data theft. OpenLoop Health has yet to publicly confirm the scale of the data breach or the validity of Stuckin2019’s claims. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, although the website of the Office of the Texas Attorney General lists an OpenLoop Health data breach affecting 68,160 state residents. That incident was published by the Texas Attorney General on March 18, 2026.

Databreaches.net reports that the Stuckin2019 is male and an individual rather than a group, who seemingly has form attacking telehealth companies. He claimed earlier this year to have attacked the New York telehealth company Zealthy, although the company has yet to publicly disclose any data breach. Databreaches reports that the OpenLoop Health forum post was only live for two days before being taken down, and in conversation with the hacker on Tox, was informed that payment was received and the data had been deleted.

The post OpenLoop Health Data Breach Affects 716,000 Individuals appeared first on The HIPAA Journal.

The National Association on Drug Abuse Problems has experienced a data breach affecting up to 90,000 individuals. An insider data breach has been discovered by Weill Cornell Medicine, and Commonwealth Care Alliance has identified a mis-mailing incident.

The National Association on Drug Abuse Problems Hacking Incident Affects 90K Individuals

The National Association on Drug Abuse Problems (NADAP), a New York-based nonprofit, has disclosed a cybersecurity incident that has affected up to 90,000 individuals. Suspicious activity was identified within its network on or around January 10, 2026. Immediate action was taken to secure its network, and an investigation was launched to determine the nature and scope of the activity. On or around January 27, 2026, NADAP determined that the protected health information of certain clients, employees, and related individuals was present in files that were subject to unauthorized access.

The files have been reviewed and found to contain names, Social Security numbers, dates of birth, medical or health information, health care treatment or diagnostic information, health insurance information, and tax or financial information. The types of data involved vary from individual to individual. NADAP has implemented additional measures to enhance network security, including strengthening password requirements and implementing conditional access policies, and the incident has been reported to regulators and law enforcement. No known threat group has claimed responsibility for the incident.

The substitute data breach notice makes no mention of complimentary credit monitoring services. The affected individuals have been advised to remain vigilant against identity theft and fraud by monitoring their accounts and explanation of benefits statements for suspicious activity.

Weill Cornell Medicine Identifies Insider Data Breach

Weill Cornell Medicine, the medical school of Cornell University in New York, has identified an insider breach involving the electronic medical records of 516 patients. Following an internal investigation, Weill Cornell Medicine confirmed that a former employee had accessed patient records for reasons unrelated to their job duties.

The potential for misuse of patient data is limited due to the nature of the data accessed, which was limited to name, contact information, and reason for visit. No Social Security numbers, clinical information, or financial information were accessed. Weill Cornell Medicine did not state the reason for the access but confirmed that the employee is no longer with the organization. All affected individuals have been notified by mail, and additional security measures have been implemented to reduce the risk of similar incidents in the future.

Commonwealth Care Alliance Announces Mis-Mailing Incident

Commonwealth Care Alliance, a Massachusetts-based health plan and care delivery system, has notified 634 individuals about a recent mis-mailing incident. The incident was identified on December 29, 2025, and involved letters intended for one member being mailed to an incorrect member. The letters included a member’s name, CCA Member ID number, and their Medicare eligibility status only. An investigation was launched to identify the cause of the error, and additional safeguards have been implemented to reduce the risk of similar incidents in the future, including supplemental quality checks with its mailing process.

The post National Association on Drug Abuse Problems Announces Data Breach Affecting 90,000 Individuals appeared first on The HIPAA Journal.

Over a three-week period between December 2025 and January 2026, hackers had access to the network of a Washington-based employee benefits administrator and potentially acquired the data of almost 2.7 million current and former participants and their dependents.

Renton, WA-based Navia Benefit Solutions, Inc., provides employee benefits administration services, including Health Care Flexible Spending Accounts and COBRA benefits. The company works with employers to manage tax-advantaged healthcare and dependent care accounts, and as such, maintains large amounts of employee data. The company has more than 10,000 clients nationwide and more than 1 million participants. The intrusion was identified on or around January 15, 2026, and the forensic investigation confirmed that its computer environment was subject to unauthorized access from December 22, 2025, to January 15, 2026. According to the breach notice provided to the Maine Attorney General, 2,697,540 individuals have been affected.

Navia Benefit Solutions uploaded a substitute breach notice to its website on March 13, 2026, and individual notification letters started to be mailed to the affected individuals on March 18, 2026. Data potentially compromised in the incident included names, email addresses, phone numbers, and Social Security numbers. The affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.

Navia Benefit Solutions said it moved quickly to respond to the incident and secure its systems, and an investigation was launched to determine the nature and scope of the incident. Federal law enforcement was notified, and the company has been working to implement additional security measures and provide its employees with additional training to prevent similar incidents in the future. Navia Benefit Solutions did not disclose whether this was a ransomware attack or if it received a ransom demand. No ransomware group has claimed responsibility for the incident.

The data breach is a reportable incident under HIPAA. The Department of Health and Human Services has been notified, and a media notice has also been issued, in compliance with the HIPAA Breach Notification Rule. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal. While it is unclear how many clients have been affected, the Washington State Health Care Authority is one of the affected clients. Navia Benefit Solutions contracted with the Washington State Health Care Authority as the administrator of its Flexible Spending Arrangement (FSA) and Dependent Care Assistance Program (DCAP) for the PEBB and SEBB Programs.

Washington State Health Care Authority, which manages Medicaid in the state, has published its own substitute breach notice. The notice confirms that records going back seven years were compromised in the incident, which relate to approximately 27,000 current and former PEBB members, 5,600 current and former SEBB members, and 3,000 current and former Compacts of Free Association (COFA) islander members. In addition, 37 school districts that contracted with Navia before the SEBB Program was implemented in January 2020 have also been notified that some of their data was potentially compromised in the incident. The impacted data includes first and last names, Navia ID numbers, addresses, phone numbers, email addresses, enrollment start and end dates, employee IDs, Social Security numbers, and dates of birth.

The post Navia Benefit Solutions Discloses Data Breach Affecting 2.7 Million Individuals appeared first on The HIPAA Journal.

Trinity Health and the University of Pittsburgh Medical Center are notifying patients about potential unauthorized access to patient data by third parties via a Health Information Exchange (HIE).

Trinity Health, a not-for-profit Michigan-based Catholic health system that operates more than 92 hospitals in 22 states, has informed state attorneys general that some of its patients may have had their protected health information accessed without authorization. Trinity Health participates in automated electronic data exchanges with Health Information Exchanges (HIEs), which ensure that patient data can be easily accessed by other healthcare providers for treatment purposes, regardless of where the provider is located.

On January 13, 2026, Trinity Health was informed by its HIE partner that there had potentially been unauthorized access to the protected health information of certain Trinity Health patients. The incident involves an HIE member called Health Gorilla, which provides an interoperability platform and manages data access requests for client companies. Health Gorilla grants access to its network to companies that require access to patient data for treatment purposes. The HIE partner warned Trinity Health that Health Gorilla claimed that health information was required for treatment purposes; however, the HIE partner said it was unable to verify whether the statements made by Health Gorilla were accurate, and whether the recipient companies had authorizations for the information they obtained via the HIE.

Data potentially accessed without authorization included clinical care details, demographic information, insurance information, and potentially driver’s license numbers. Health Gorilla has suspended access to the HIE for the companies concerned. Trinity Health is providing the affected individuals with complimentary credit monitoring and identity theft protection services for 24 months. The number of affected individuals has not yet been disclosed.

University of Pittsburgh Medical Center (UPMC) patients have also been affected and are in the process of being notified about the potential unauthorized access. Data potentially accessed without a valid authorization included names, ages, diagnoses, and other information from patients’ medical histories. UPMC said it was informed about the potential unauthorized access by its electronic medical record vendor (Epic), and similarly, the unauthorized access occurred through an HIE via Health Gorilla. The incident has been reported to the HHS’ Office for Civil Rights, although it is not yet shown on the breach portal, so it is unclear how many patients have been affected.

Further healthcare providers are expected to issue similar notices in the coming days and weeks.

Legal Action Taken Over Alleged Unauthorized Access and Disclosures

Legal action is being taken over the alleged impermissible disclosures by Epic, OCHIN, and several healthcare providers who allege that Health Gorilla and others enabled “sham” companies to access their platforms to obtain patient data from national HIEs. While not stated in the breach notice, the information accessed by the sham companies may have been disclosed to third parties, such as law firms. One of the companies named as a defendant has admitted to making fraudulent claims that data was required for treatment purposes, when the data was disclosed to law firms. The lawsuit is proceeding against the other named defendants. Health Gorilla, a Qualified Health Information Network (QHIN), denies any wrongdoing, and so far, only one of the defendants has admitted wrongdoing.  You can read more about the lawsuit in this post.

The post Trinity Health & UPMC Notify Patients About Potential Unauthorized Data Access via HIE appeared first on The HIPAA Journal.