Astrana Health, a managed services organization that helps healthcare providers deliver value-based, coordinated care to patients, has notified the U.S. Securities and Exchange Commission (SEC) about a material cybersecurity incident that exposed patient, employee, and provider information.

According to the Form 8-K filing, Astrana Health subsidiary Astrana Health Management identified unusual activity within its information technology environment. The forensic investigation found that threat actors had conducted a series of social engineering attempts against employees. The threat actors impersonated company personnel and spoofed the company’s main telephone number and tricked employees into providing them with access to company systems.

The company engaged a third-party cybersecurity and digital forensics firm to assist with the investigation and notified law enforcement. Steps have been taken to bolster security to prevent similar incidents in the future, including resetting all affected credentials, restricting the use of remote access tools, restoring systems from clean backups, and enhancing monitoring.

The investigation and data review are ongoing; however, Astrana Health believes that certain private and/or confidential information stored on the affected servers has been accessed and/or acquired. Data is being reviewed to determine what patient, employee, credentialed provider, intellectual property, and confidential business and financial information may be involved. On September 22, 2026, the company determined that it constitutes a material cybersecurity incident due to the confidential and sensitive nature of the data involved.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

At the time of issuing the Form 8-K filing, Astrana Health was unable to estimate the full impact of the incident on the company’s business strategy, operations, financial condition, or results of operations. The company holds a cyber insurance policy that may cover certain losses associated with the incident. Currently, no ransomware or cybercriminal group appears to have claimed responsibility for the cyberattack.

The post Astrana Health Notifies SEC About Social Engineering Incident appeared first on The HIPAA Journal.

Data breaches have been announced by Modoc Medical Center and Vista Del Mar Child and Family Services in California, Park Place Behavioral Healthcare in Florida, and Millstone Medical Outsourcing in Massachusetts.

Modoc Medical Center

Modoc Medical Center, a 12-bed critical access hospital and rural healthcare system based in Alturas, California, has identified unauthorized access to its computer network. The unauthorized access was detected on January 27, 2026, and cybersecurity specialists were engaged to help secure its systems and investigate and determine the nature and scope of the incident. The investigation confirmed that an unknown actor had access to parts of its computer network between January 19, 2026, and January 27, 2026, and downloaded certain files, some of which contained patients’ personal and protected health information.

The review of the data has been completed, and notification letters are now being sent to the affected individuals. The data types involved varied from individual to individual and are detailed in the individual notification letters. The data involved included names in combination with one or more of the following: Social Security number, driver’s license or state identification number, financial account information, payment card information, passport number, military identification number, medical information, and/or health insurance information.

The affected individuals have been offered 12 or 24 months of complimentary credit monitoring and identity theft protection services, and steps have been taken to strengthen security to prevent similar incidents in the future. The Worldleaks ransomware and data extortion group claimed responsibility for the attack. It is unclear whether ransomware was involved.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Vista Del Mar Child and Family Services

Vista Del Mar Child and Family Services, a Los Angeles, California-based nonprofit provider of mental health, education, and social services to children, adolescents, and their families, is reviewing the data exposed in a recent cybersecurity incident. Suspicious activity was identified within its computer systems on June 30, 2026, indicative of an intrusion. Its incident response protocols were activated, containment measures deployed, and an investigation was launched. Third-party cybersecurity professionals were engaged to help determine the nature and scope of the incident and confirmed that an unauthorized third party had accessed systems containing personal and protected health information.

There was no impact on its operations, and services continued to be provided to all individuals as scheduled. The data review is ongoing, and it is too early to confirm the number of individuals affected or the data types involved. Notification letters will be mailed to the affected individuals when those processes are completed. In the meantime, the data breach has been reported to the HHS’ Office for Civil Rights as involving the protected health information of at least 500 individuals. Vista Del Mar Child and Family Services said law enforcement has been notified, it is reviewing its security policies, protocols, and procedures, has implemented additional security controls, and is working on optimizing its endpoint monitoring software.

Park Place Behavioral Healthcare

Park Place Behavioral Healthcare (formerly Osceola Mental Health Inc.), a community behavioral health provider in Osceola County, Florida, that provides mental health and substance use services, has notified patients about a recent cybersecurity incident. Suspicious activity was identified within its computer network on July 23, 2026. Third-party cybersecurity experts were engaged to investigate the activity, and on August 19, 2026, the investigation was completed and confirmed that its network had been accessed by an unauthorized third party.

A file review was initiated, and on September 17, 2026, Park Place Behavioral Healthcare obtained the final list of individuals to notify. The data involved varied from person to person and may have included names in combination with one or more of the following: dates of birth, Social Security numbers, driver’s license numbers/other government-issued ID numbers, financial account information, health information, and/or health insurance information.

Park Place Behavioral Healthcare said several steps have been taken in response to the incident, including resetting user account credentials, installing endpoint detection and response software for continuous monitoring, and refining the security of its remote access methods. The number of affected individuals has not currently been publicly disclosed. The Insomnia ransomware group claimed responsibility for the attack and listed the stolen data on its dark web data leak site, which indicates that the ransom was not paid.

Millstone Medical Outsourcing

Millstone Medical Outsourcing, a Fall River, Massachusetts-based medical device outsourcing company, has identified a cybersecurity incident that exposed personal and health information. The forensic investigation determined that an unauthorized third party first accessed parts of its network on December 15, 2025. The intrusion was detected on December 16, 2025, and the forensic investigation determined that its network had been accessed by an unauthorized third party between December 15, 2025, and December 19, 2025, during which time files were acquired.

The data review confirmed on July 15, 2026, that the stolen data included Social Security numbers, government identification numbers, financial account codes, credit/debit card information, and health records. The affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months. No misuse of the affected information had been identified at the time of issuing notification letters. The number of affected individuals has not been publicly disclosed at the time of publication of this article.

The post California Critical Access Hospital Announces Cybersecurity Incident appeared first on The HIPAA Journal.

Notification letters are being mailed to individuals affected by data breaches at the pharmacy benefit management service provider MedImpact Healthcare Systems and the healthcare software company Rosch Visionary Systems.

MedImpact Healthcare Systems

MedImpact Healthcare Systems, a provider of pharmacy benefit management services to health plans, government entities, and self-insured employers, identified unauthorized activity within its computer network in October 2025. Immediate action was taken to secure its computer systems and prevent further unauthorized access, and an investigation was launched to determine the nature and scope of the incident.

The investigation was finalized on July 17, 2026, and the affected clients were informed about the data breach on August 13, 2026. Notification letters started to be sent to the affected individuals by MedImpact Healthcare on behalf of its affected clients on September 23, 2026. Data compromised in the incident included names in combination with some or all of the following: address, date of birth, subscriber number, Social Security numbers, health insurance information, health-related information such as prescription information, treatment information, dates of service, service locations, and provider names. The affected clients and number of affected individuals have not been publicly disclosed.

Individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services. At the time of issuing notification letters, no misuse of the affected data had been identified. The Qilin ransomware group claimed responsibility for the data breach and added MedImpact Healthcare to its dark web data leak site in October 2025. Qilin claimed to have exfiltrated sensitive data in the incident and threatened to leak the data if the ransom was not paid.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Rosch Visionary Systems

Rosch Visionary Systems, a Pennsylvania-based software company that provides allergy and immunotherapy management software for medical practices, has experienced a cybersecurity incident that compromised part of its computer network. The breach notifications sent to state attorneys general do not state when the breach occurred, when it was detected, or the nature of the unauthorized activity. Healthcare providers that use its software have been notified, and individual notification letters are being mailed to the affected individuals. Complimentary credit monitoring and identity theft protection services have been offered for 24 months.

The scale of the data breach and specific types of information involved are unclear. Healthcare provider clients known to have been affected include Allergy, Asthma and Food Allergy Centers and Texas Regional Asthma, Allergy & Immunology Center. This appears to have been a ransomware attack or data theft and extortion incident. A threat group called Lynx claimed responsibility for the cyberattack and alleged that sensitive data was stolen from Rosch Visionary Systems. The company is no longer listed on the Lynx data leak site, which suggests that a ransom payment was negotiated.

The post Data Breaches Announced by MedImpact Healthcare Systems; Rosch Visionary Systems appeared first on The HIPAA Journal.

Data breaches have been announced by Gastroenterology & Hepatology of Central New York, Three Oaks Hospice, and Doctor’s Choice Home Care.

Gastroenterology & Hepatology of Central New York

Gastroenterology & Hepatology of Central New York, a medical practice specializing in digestive disorders and liver disease with locations in Liverpool and Syracuse, has started notifying patients about a cybersecurity incident first identified on March 6, 2026. Immediate action was taken to contain the threat, and third-party cybersecurity and digital forensics experts were engaged to investigate the activity. The forensic investigation confirmed unauthorized access to certain systems and the exfiltration of files from its network on or around March 6, 2026.

The stolen files contained full names, addresses, phone numbers, dates of birth, Social Security numbers, and medical record numbers. The affected individuals were notified on September 17, 2026, and complimentary credit monitoring and identity theft protection services have been made available. At the time of issuing the notifications, no misuse of the affected data had been identified. The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

Three Oaks Hospice / Elevation Hospice

Dallas, Texas-based Three Oaks Hospice, a medical service provider specializing in hospice care, identified unauthorized access to its email environment on August 8, 2025. Assisted by cybersecurity experts, Three Oaks Hospice determined that limited email accounts had been accessed by an unauthorized third party and personal information was exposed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Three Oaks Hospice, along with its sister companies Agape Hospice Care, Elevation Hospice of Colorado, and Sage Hospice of Arizona, provides hospice and palliative care services in 9 U.S. states. It took more than a year for its affiliated hospices to be notified that they had been affected. The affected hospices were notified on August 17, 2026, and the affected individuals were notified on September 17, 2026.

Data exposed in the incident includes names, dates of birth, Social Security numbers, driver’s license numbers, medical information, and health insurance information. The number of affected individuals has yet to be publicly disclosed. The Texas attorney general was notified that 3,034 Texas residents were affected.

Doctor’s Choice Home Care (WellSky)

Houston, Texas-based Doctor’s Choice Home Care, a home care and hospice provider, has been affected by a data breach at its electronic medical record vendor, WellSky. WellSky identified the incident on July 21, 2026, and its forensic investigation determined that an unauthorized third party gained access to a WellSky clinical user account within the electronic medical record system between June 5, 2026, and July 24, 2026.

Data exposed and potentially stolen included names, addresses, birth dates, Social Security numbers, scheduling information, clinical information, treatment information, and health insurance information. Doctor’s Choice Home Care confirmed that its internal systems were unaffected. The incident is not yet shown on the HHS’ Office for Civil Rights website. The Texas Attorney General was notified that 14,333 Texas residents have been affected.

The post Data Breaches Announced by Gastroenterology Practice and Hospice Companies appeared first on The HIPAA Journal.

Texas-based Oculus Pathology has disclosed a data breach affecting more than 20,000 patients. Data breaches have also been announced by Paradigm Healthcare Services in California and LeMaitre Vascular in Massachusetts.

Oculus Pathology, Texas

Oculus Pathology, an Austin, Texas-based anatomic and clinical pathology laboratory that provides services to hospitals, ambulatory surgery centers, and physician groups, has notified 20,040 patients that some of their protected health information has been exposed and potentially stolen.

On April 1, 2026, suspicious activity was identified related to an employee’s email account. Action was taken to secure its email system, and third-party cybersecurity specialists were engaged to investigate the activity and determine the nature and scope of the incident. The investigation determined that the account had been accessed by an unauthorized third party, and other email accounts were also compromised between March 31, 2026, and April 2, 2026.

The affected email accounts were reviewed to determine the individuals affected and types of data involved. The data review determined that personally identifiable information and protected health information were exposed, including names, dates of birth, Social Security numbers, driver’s license/ state identification numbers, individual tax identification numbers, financial account numbers (with or without access information), payment card numbers (with or without access information), clinical information, provider names, health insurance information, diagnoses, prescription information, medical treatment/procedure information, medical record numbers, Medicare numbers, and patient IDs. No misuse of the exposed information has been detected; however, the affected individuals have been advised to remain vigilant against identity theft and fraud.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Paradigm Healthcare Services, California

Paradigm Healthcare Services, a San Francisco, California-based third-party school Medi-Cal billing company, identified unauthorized access to its local computer network on October 13, 2025. Third-party cybersecurity professionals were engaged to investigate the incident and determine the nature and scope of the activity.

The investigation confirmed that the unauthorized access was limited to its local network between October 8, 2025, and October 15, 2025. The online service documentation and billing platform and Student Health Network were not affected. Data exposed in the incident included names, dates of birth, gender information, and Medi-Cal member identification numbers. The data breach has been reported to the California Attorney General. The number of affected individuals has yet to be publicly disclosed.

LeMaitre Vascular, Massachusetts

LeMaitre Vascular, a Burlington, Massachusetts-based medical device company that makes products for treating peripheral vascular disease, has notified regulators about a breach of patient information. The company experienced a network disruption that confirmed that its network was accessed by an unauthorized third party, who may have viewed or obtained sensitive information. It is unclear when the breach occurred and when it was detected; however, the review of the exposed files was completed on September 14, 2026.

Data compromised in the incident included names, Social Security numbers, USCIS Alien Registration numbers, driver’s license numbers, financial account numbers, and medical records. The number of affected individuals has yet to be publicly disclosed, although almost 1,000 Massachusetts residents are known to have been affected.

The post Oculus Pathology Notifies 20,000 Patients About April 2026 Security Incident appeared first on The HIPAA Journal.

Data breaches have been announced by United Language Group in Minnesota, Desert Pulmonary & Sleep Consultants in Arizona, and Azle Cube Smiles in Texas.

United Language Group, Minnesota

United Language Group, LLC, a Minneapolis, Minnesota-based provider of translation, localization, and interpretation services, has notified the HHS’ Office for Civil Rights about a breach of the protected health information of 4,649 individuals. Suspicious activity was identified within certain parts of its network on July 9, 2025. The forensic investigation confirmed that parts of its network were accessed by unauthorized individuals between July 8, 2025, and July 9, 2025

According to its notification letters, the breach involved unauthorized access to data provided by clients UnitedHealthcare and UnitedHealthcare Global related to claims, billing, and other member/provider communications. The impacted data included names, contact information, health insurance information, health information ( diagnoses, treatment information, prescriptions, and provider and related information), Social Security numbers, financial account information, driver’s license information, passports, military IDs, residence permit information, and financial account information, including credit or debit card numbers. The types of data involved varied from individual to individual.

Additional monitoring tools have been implemented, and security measures will continue to be assessed and enhanced. The affected individuals have been offered 24 months of credit monitoring and identity theft protection services.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Desert Pulmonary & Sleep Consultants, Arizona

Desert Pulmonary & Sleep Consultants, a Gilbert, Arizona-based medical practice specializing in pulmonary disease and sleep medicine, has notified the HHS Office for Civil Rights about a data privacy incident. A former physician partner left Desert Pulmonary & Sleep Consultants to practice elsewhere. On or around July 13, 2026, Desert Pulmonary & Sleep Consultants identified suspicious activity related to the physician. An investigation was launched, which revealed the former partner copied patient data during his transition period, starting on June 29, 2026. Over the course of three days, he accessed more than 3,000 names and addresses, as well as protected health information of patients – information collected as part of patient visits and information provided by other medical service providers.

The data was accessed with a view to contacting the patients by mail to inform them about his new practice. The data was disclosed to another individual to assist with the mailing of the letters. The physician was contacted by legal counsel of Desert Pulmonary & Sleep Consultants and was informed not to engage in such activity; however, no response was received from the physician or his legal counsel.

Azle Cube Smiles, Texas

Azle Cube Smiles, a dental practice in Azle, Texas, has notified the Texas Attorney General about a data security incident affecting 2,940 Texas residents. On May 26, 2026, the practice was notified by its IT support company about suspicious activity related to remote access session hosts. Its remote desktop web services infrastructure was locked down, including terminating all external connections. An investigation was launched to determine the nature and scope of the activity, and it was quickly determined that a cyberattack had occurred.

An office-wide password reset was performed, and no further unauthorized access has been detected.  Azle Cube Smiles said it was rapidly able to restore its patient record platform. The investigation determined that some patient data was potentially accessed or copied, including names, addresses, dates of birth, driver’s license numbers, government-issued IDs, and medical information. Financial information was not involved, nor was information about the dental care provided to patients. Azle Cube Smiles said its IT support company has been conducting regular security inspections and is continuously monitoring its systems to protect against further breaches.

The post Data Breach at Translation Vendor Affects UnitedHealthcare Plan Members appeared first on The HIPAA Journal.

A hacking group has claimed responsibility for an August 2026 cyberattack on Cedar County Memorial Hospital in Missouri. Hacking-related data breaches have been reported by Next Level Medical in Texas and Grafton City Hospital in West Virginia.

Cedar County Memorial Hospital

Cedar County Memorial Hospital in El Dorado Springs, Missouri, disclosed on August 23, 2026, that it was the victim of a cyberattack that disrupted its IT systems. The affected computer systems were taken offline, and network access was paused to ensure the integrity of hospital systems. The measures taken to contain the attack and protect its systems resulted in an outage of its patient portal and electronic health record system, and the latter affected all hospital and Medical Mall Clinic services. To ensure patient safety, the emergency department was placed on partial diversion since medical imaging systems were unable to transmit medical images to radiologists.

An update was issued by Cedar County Memorial Hospital on August 28, 2026, confirming that the hospital had returned to routine operations after internal and external teams had completed all system reviews and safety checks. The EHR system was brought back online after two weeks offline, and manually recorded information is now being transferred to the EHR.

In a September 10, 2026, update, Cedar County Memorial Hospital explained that the investigation and review of exposed data are continuing, and it has yet to be confirmed to what extent patient data had been compromised. When the investigation and data review processes are completed, patients will be notified if their personal and/or protected health information was exposed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

A relatively new cyber extortion and ransomware group called Wallstreet claimed responsibility for the attack. The group added Cedar County Memorial Hospital to its dark web data leak site in late August and threatened to publish data stolen in the attack. The group’s claim has yet to be verified.

Next Level Medical

Next Level Medical, a Texas-based primary and urgent care provider with more than 45 clinics across the state, has recently disclosed a data security incident that was first identified on July 11, 2026. Steps were taken to secure its environment and investigate the activity; however, further suspicious activity was identified on July 29, 2026. Assisted by third-party cybersecurity experts, further steps were taken to secure its environment and bring systems back online safely and securely.

Next Level Medical determined that an unauthorized third party had accessed its network and copied files, some of which contained patient information. The investigation and file review are ongoing to determine the extent to which patient data was involved and the individuals affected. Next Level Medical said that the initial findings of the investigation indicate that data compromised in the incident includes names, dates of birth, demographic information, Social Security numbers, health information, and health insurance information. This appears to have been a data theft and extortion incident by the PEAR threat group. Ransomware Live identified a listing on the PEAR data leak site; however, it appears to have now been removed.

Grafton City Hospital

Grafton City Hospital (now Vandalia Health Grafton Hospital), a critical access hospital in West Virginia, has notified 1,215 individuals that some of their protected health information was exposed in a recent cybersecurity incident. The incident occurred at Monongalia County General Hospital Company, part of the Vandalia Health network, and was due to a phishing attack.

The incident was detected on May 6, 2026, the same day of the attack, and the investigation determined that several email accounts were compromised. The investigation was completed in late June and confirmed that data compromised in the incident included names, birth dates, addresses, phone numbers, Social Security numbers, health information, and health insurance information. Technical safeguards have been enhanced to prevent similar incidents in the future, and the affected individuals have been offered two years of complimentary credit monitoring services.

The post Hacking Group Claims Attack on Cedar County Memorial Hospital appeared first on The HIPAA Journal.

A data breach at zHealth, a practice management and EHR software provider, has affected 118,000 individuals. Data breaches have also been announced by Bridgeway Benefit Technologies, Longview ER Operations, and HealthStream.

zHealth

zHealth, Inc., a San Francisco, California-based cloud-based practice management and electronic health records (EHR) software provider, has disclosed a cybersecurity incident that may have involved data being acquired by an unauthorized third party. According to the breach notice provided to the California Attorney General, zHealth became aware that certain information may have been copied on or around June 15, 2026. An investigation was launched, which confirmed that its network had been accessed by an unauthorized third party between January 20 and January 21, 2026. The review of the impacted data was completed on September 3, 2026.

The substitute breach notice on the zHealth website states that the impacted information varies from individual to individual and may include names, medical information, and health insurance information. The affected individuals have been offered single-bureau credit monitoring, credit report, and credit score services for 12 months. Data privacy and security policies and procedures have been reviewed and enhanced to prevent similar incidents in the future. The incident is not currently shown on the HHS’ Office for Civil Rights website; however, the Oregon Attorney General has been informed that the data breach affected 118,563 individuals.

Bridgeway Benefit Technologies

Bridgeway Benefit Technologies, a Baltimore, Maryland-headquartered third-party health plan administrator that provides software for managing multiemployer health, welfare, and retirement benefits, has notified the HHS Office for Civil Rights about a breach of the protected health information of 9,268 individuals. The company explained that it experienced a cybersecurity incident involving an employee email account that exposed data provided to the company in connection with the administration services it provides to its clients. The unauthorized activity was identified on May 18, 2026, and the forensic investigation determined that the account was accessed between March 5, 2026, and May 19, 2026.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Bridgeway Benefit Technologies confirmed that the breach was limited to its own email system. No client systems were compromised in the incident. The exact types of data involved are detailed in the individual notification letters. Attorneys General have been notified that the compromised data includes Social Security numbers. Steps have been taken to improve security to prevent similar incidents in the future, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services.

Longview ER Operations

Longview ER Operations, LLC, doing business as Hospitality Health ER, a full-service emergency room operator with facilities in Longview, Tyler, and Galveston, Texas, has experienced a cybersecurity incident that involved patient data. Suspicious network activity was identified on July 22, 2026. Immediate action was taken to secure its systems, and an investigation was launched to determine the nature and scope of the activity, with assistance provided by third-party cybersecurity professionals.

The investigation confirmed that an unauthorized third party had accessed its network and copied files. The file review is ongoing, and patients will be notified by mail as soon as the review is concluded. The notification letters will explain the types of information involved for each patient. The incident was limited to the Longview network. The facilities in Tyler and Galveston were unaffected. The number of affected individuals has not yet been determined. The incident has been reported to the HHS’ Office for Civil Rights using an estimate of at least 501 individuals. The total will be updated when the review is completed.

HealthStream

HealthStream Inc., a Nashville, Tennessee-based healthcare technology company that provides software and training solutions for the healthcare industry, has notified the Massachusetts Attorney General about a recent security incident. The letter provides no information about the nature of the data breach, other than stating that some “information” was involved and complimentary credit monitoring and identity theft protection services have been offered for 24 months. “Due to requirements imposed by Massachusetts law, we are unable to provide you with the details about the nature of this incident,” states the notification letter.

The notification letters appear to be about a cybersecurity incident reported to the U.S. Securities and Exchange Commission (SEC) on July 29, 2026. According to the Form 8-K filing, the incident involved unauthorized access to corporate file servers and does not appear to have involved protected health information. Data compromised in the incident included employee data, customer and vendor billing data, and legal information. Around 75 of its credentialing customers have been affected. HealthStream said no customer-facing systems were involved, there was no file encryption, operations were not disrupted, and the incident is unlikely to affect its financial position or results.

The post xHealth Data Breach Affects 118,000 Individuals appeared first on The HIPAA Journal.