Four employees of Baptist Health’s Jay Hospital in Florida have been terminated for allegedly taking unauthorized photographs of patients and sharing the images on the Snapchat social media platform. The privacy violations reportedly occurred in February 2025. The employees were alleged to have entered patients’ rooms late at night and photographed patients while they were sleeping or medicated without the patients’ knowledge or consent.

Personal injury attorney Joe Zarzaur was contacted by three patients who were recently notified about the privacy violations by the hospital. It is unclear why it took so long for the affected patients to be notified, or how many patients have been affected. The nature of the photographs was not disclosed to the patients. According to Zazaur, the patients were informed that the photographs were “unflattering” and “horrible.” They were not told how many photographs were taken, exactly what the photographs showed, and were not allowed to see any of the images.

One of the patients was notified about the privacy violation while they were still admitted at Jay Hospital, and another was informed when they visited an outpatient rehab facility. At least two of the affected patients are taking legal action for invasion of privacy and are being represented by Zarzaur.

“Upon learning of the allegation, we immediately conducted a preliminary investigation and notified the appropriate authorities and the patients,” explained a spokesperson for Jay Hospital. “Following the investigation, the individuals involved were terminated. We are committed to protecting the privacy, safety, and dignity of our patients. As this matter involves patient privacy and is currently under investigation, we are unable to share further details at this time.”

The sharing of protected health information (PHI) for reasons unrelated to treatment, payment, or hospital operations is not permitted by the HIPAA Privacy Rule, unless consent is obtained from the subject of the PHI.  Photographs of patients are classed as PHI, and the employees clearly violated HIPAA as well as ethical and professional standards.

The post Florida Hospital Fires Employees for Taking Unauthorized Photographs of Sedated Patients appeared first on The HIPAA Journal.

Cyberattacks have recently been announced by River City Eye in Oregon and Elmcrest Children’s Center in New York.

River City Eye Care

River City Eye Care, an eye care provider with locations in Portland and Happy Valley, Oregon, has started notifying patients about a recent security incident involving the theft of files containing patient information. Unusual network activity was detected on or around September 8, 2025, and an investigation was launched to determine the nature and scope of the activity.

The investigation confirmed unauthorized access to its network and the exfiltration of files. The affected files were reviewed, and River City Eye Care completed the review on October 1, 2025. The types of information involved vary from individual to individual and may include names in combination with one or more of the following: address, email address, phone number, and date of birth.  Driver’s license numbers and Social Security numbers were involved for a limited number of individuals. Notification letters started to be mailed on October 16, 2025, and steps are being taken to reduce the risk of similar incidents in the future. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

The Genesis threat group claimed responsibility for the attack and has added River City Eye to its data leak site. The group claims it operates a data extraction operation (no file encryption) and says it exfiltrated 200 GB of data from company management hosts and file servers, which has been made available for download. The HIPAA Journal has not downloaded any data, so cannot verify the legitimacy of the group’s claim.

Elmcrest Children’s Center

Elmcrest Children’s Center, a Syracuse, NY-based provider of support services to children with emotional, behavioral, and developmental limitations and their families, has recently disclosed a security incident involving unauthorized access to its network. The investigation into the incident is ongoing, but it has been confirmed that its network was subject to unauthorized access between March 10, 2025, and July 24, 2025, during which time files were accessed and acquired by the threat actor.

The files are still being reviewed, but based on the initial findings, the types of information involved include names, dates of birth, and medical information. Technical and administrative policies and procedures are being reviewed and will be updated to reduce the risk of similar incidents in the future. Elmcrest Children’s Center has yet to disclose how many individuals have been affected; however, the data breach does appear to be significant. The Interlock ransomware group has claimed responsibility for the attack and says almost 450 GB of data was copied.

The post Oregon Eye Care Provider and New York Children’s Center Announce Hacking Incidents appeared first on The HIPAA Journal.

Data breaches have recently been announced by Watsonville Community Hospital and Palomar Health Medical Group in California, and the Phia Group in Massachusetts.

Watsonville Community Hospital

Watsonville Community Hospital in California is notifying individuals affected by a November 2024 security incident. Suspicious activity was identified within its computer systems on November 29, 2024, and the investigation confirmed that there had been unauthorized access to its network from November 25, 2024, to November 30, 2024, when the hackers were ejected from its network. The investigation confirmed that files containing patient information were either accessed or downloaded during those five days.

The file review confirmed that the data compromised in the incident included names, addresses, and driver’s license numbers or government ID numbers, with the exposed data varying from individual to individual. Notification letters started to be sent to the affected individuals on December 30, 2024; however, the file review was not completed until September 22, 2025. The final batch of notification letters started to be mailed on October 15, 2025.

The affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months. Watsonville Community Hospital has implemented additional cybersecurity safeguards and has provided further training to its workforce. The incident is not currently shown on the HHS’ Office for Civil Rights website, so it is currently unclear how many individuals have been affected.

Palomar Health Medical Group

Arch Health Partners, Inc., doing business as Palomar Health Medical Group, in Poway, California, has started notifying patients about a data security incident first identified on May 5, 2024. Palomar Health Medical Group launched an investigation into suspicious network activity and confirmed that an unauthorized threat actor gained access to certain files on its network on April 23, 2024, and maintained access until the data breach was detected on May 5, 2024. During that time, files may have been copied that contained patient information.

The data compromised in the incident included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, state identification numbers, military identification numbers, passport numbers, U.S. alien registration numbers, financial account information, payment card information, health savings account information, medical histories, diagnostic information, treatment information, biometric data, medical record numbers, Medicare/ Medicaid identification numbers, patient account numbers, health insurance information, email addresses and passwords, and usernames and passwords.

Palomar Health Medical Group had previously announced the cyberattack and data breach; however, it took until September 4, 2025, to finish the review of the affected files to allow notification letters to be sent. Complimentary credit monitoring and identity theft protection services have been made available for 12 or 24 months, and steps have been taken to improve security to prevent similar incidents in the future. The incident is not currently shown on the HHS’ Office for Civil Rights website, so it is currently unclear how many individuals have been affected.

The Phia Group

The Phia Group, a Canton, Massachusetts-based provider of outsourced cost containment and payment integrity solutions to healthcare payers, has recently notified the Massachusetts Attorney General about a recent data security incident. The notice is a copy of the data breach notifications sent to the affected individuals, and it provides no information about the nature of the data breach, such as when it occurred, when it was detected, or the cause of the breach. The data potentially compromised in the incident includes names, Social Security numbers, and medical record numbers. The affected individuals have been offered complimentary credit monitoring and identity theft protection services. The incident is not currently shown on the HHS’ Office for Civil Rights website, so it is currently unclear how many individuals have been affected.

This post will be updated when further information becomes available.

The post Data Breaches Announced by Watsonville Community Hospital & Palomar Health Medical Group appeared first on The HIPAA Journal.

Cyberattacks and data breaches have been announced by Crenshaw Community Hospital in Alabama, Waveny LifeCare in Connecticut, Aunt Martha’s Health and Wellness in Illinois, Pulse Urgent Care Center in California, and MyCardiologist in Florida.

Crenshaw Community Hospital

Crenshaw Community Hospital in Luverne, Alabama, has recently announced a security incident. Crenshaw Community Hospital said the incident was detected on June 16, 2025, and involved “network disruption that impacted the functionality and access of certain computer systems.” Third-party cybersecurity experts were engaged to investigate the incident and provide help with securing its environment. The investigation into the attack is ongoing, but it has been determined that certain files were copied from its systems.

The ransomware group, Payouts King, has claimed responsibility for the attack. The group is known to engage in double extortion, stealing data and demanding payment to prevent its publication and for the decryption keys to unlock files. The group claims to have exfiltrated 53 GB of data, and has listed Crenshaw Community Hospital on its dark web data leak site, and claims to have published the entire dataset as the ransom was not paid.

Crenshaw Community Hospital is still reviewing the affected data to determine the individuals affected and the types of data involved. Individual notification letters will be mailed when the file review is concluded. In the meantime, all patients have been advised to remain vigilant against identity theft and fraud by monitoring their account statements, explanation of benefits statements, and free credit reports.

Waveny LifeCare

Waveny LifeCare Network, a New Canaan, Connecticut-based provider of senior living and healthcare services, has experienced a cyberattack that disrupted its network systems. The attack was detected on or around May 28, 2025, and immediate action was taken to contain the incident and secure its systems. Waveny LifeCare engaged third-party cybersecurity experts to assist with the investigation, who confirmed that the attackers accessed certain data on its network.

The investigation and file review are ongoing, but it has been confirmed that the following types of information were involved: name, address, date of birth, admission/discharge date, date of death, telephone number, email address, Social Security number, medical record number, patient account number, facial photographic images, laboratory test results, medical imaging results, driver’s license number, electronic health records, health insurance account or policy number, payment information, Medicare or Medicaid information, and/or financial account number. While sensitive data was accessed, no evidence has been found to date to indicate that any of that information has been misused. Notification letters will be sent to the affected individuals when the file review is concluded.

Aunt Martha’s Health and Wellness

Aunt Martha’s Health and Wellness, a provider of community health, wellness, and support services in Illinois, has fallen victim to a ransomware attack. The attack was detected on August 13, 2025, when suspicious network activity was observed. The forensic investigation confirmed that a threat actor gained access to its computer network on August 12, 2025, exfiltrated sensitive data, and deployed malware that encrypted files. The attack was rapidly contained, and systems and data were restored from backups, without paying the ransom. No evidence has been found to indicate that any of the compromised data has been misused; however, the affected individuals have been advised to remain vigilant against identity theft and fraud.

While the file review is ongoing, Aunt Martha’s Health and Wellness has identified the general categories of information exposed in the incident as name, address, birth date, provider/facility name, medical condition, diagnosis information, treatment information, lab results, prescriptions/medications, personal history, mental health information, insurance/payment amount history information, date(s) of service, Social Security number, medical information, health insurance information, and driver’s license or state identification number. Other information created, used, or disclosed in the course of providing health care services may also have been compromised.

Pulse Urgent Care Center

Pulse Urgent Care Center, which has locations in Redding and Red Bluff in California, is alerting patients about a network security breach that was identified on March 24, 2025.  The incident was investigated and determined to involve network access by an unauthorized third party who deployed malicious software. The attack caused temporary disruption to its IT systems; however, network access and data were rapidly restored from backups, and normal operations were quickly resumed.

The investigation confirmed on May 1, 2025, that some patient data had been exposed and many have been viewed or acquired. The types of data involved vary from individual to individual, and may include names, dates of birth, home addresses, phone numbers, diagnoses, service dates, and treatment information. Pulse Urgent Care Center has strengthened its web server infrastructure and has implemented enhanced safeguards to prevent similar incidents in the future. Individual notification letters state the specific information involved for each individual. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

MyCardiologist

Cardiovascular Medicine Associates, PA, which does business as MyCardiologist, a cardiology practice with nine locations in South Florida, is alerting patients about a cyberattack involving the theft of data from its network. The attack was detected on June 12, 2025, when suspicious activity was observed within its email system. Third-party investigators determined that its email system was compromised on May 30, 2025, and an unauthorized third party had access to its environment until June 12, 2025, when the security breach was identified and blocked. The forensic investigation confirmed that the threat actor copied data from its environment.

Notification letters started to be mailed to the affected individuals on October 7, 2025, following a comprehensive and time-consuming review of the affected data. The review confirmed that names, addresses, dates of birth, clinical information, diagnoses, provider names/locations, and Medicare numbers were compromised in the incident. No evidence has been found to indicate that any of the impacted data has been misused; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Five Healthcare Providers Warn Patients About Cyberattacks & Data Breaches appeared first on The HIPAA Journal.

Data breaches have recently been announced by Methodist Homes of Alabama & Northwest Florida, Rockhill Women’s Care, and Sierra Vista Hospital & Clinics.

Methodist Homes of Alabama & Northwest Florida

Methodist Homes of Alabama & Northwest Florida, a provider of affordable homes, senior living, and healthcare services, disclosed a data breach on October 8, 2025, involving unauthorized access to the personal and protected health information of almost 26,000 residents, employees, and other individuals. The breach occurred almost one year previously, having first been detected on October 14, 2024.

An investigation was launched to determine the cause of suspicious network activity, which confirmed that an unauthorized actor had access to its network between October 2, 2024, and October 14, 2024. During that time, sensitive data may have been accessed or acquired. All exposed files were reviewed, and that process was completed on September 2, 2025. Notification letters have now been mailed to all individuals with valid contact information, and regulators have been notified, including the HHS’ Office for Civil Rights.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal; however, the Maine Attorney General was informed that 25,579 individuals have been affected in total. The information involved varies from individual to individual and may include names in combination with one or more of the following: Social Security number, driver license or state ID number, health insurance number, and clinical information, including medical record number, medical history, diagnosis and treatment information, patient number, Medicaid/Medicaid number, date of discharge, and date of birth.

Individuals who were neither patient nor resident had their first and last name exposed, plus one or more of the following: Social Security number, driver’s license number, state ID, health insurance number, and medical history information. Credit monitoring services have been offered free of charge to individuals whose Social Security numbers were involved.

Rockhill Women’s Care

The OB-GYN medical practice, Rockhill Women’s Care, which has locations in Overland Park, Kansas, and Lee’s Summit, Missouri, has started notifying patients about a security incident that affected its IT systems and exposed patient information. Suspicious network activity was identified on or around February 26, 2025, and third-party cybersecurity experts were engaged to investigate the activity and assist with remediation. The substitute breach notice does not state when its network was first accessed or for how long hackers had access to the network.

The file review concluded on August 13, 2025, when it was confirmed that the information compromised in the incident included names, addresses, dates of birth, Social Security numbers, treatment information, and, for some patients, also health insurance information. The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

Sierra Vista Hospital & Clinics

Sierra Vista Hospital & Clinics in Truth or Consequences, New Mexico, has identified unauthorized access to its computer network and the exposure of patient information. The unauthorized access was identified on January 29, 2025, and working with third-party digital forensics specialists, it was determined that a threat actor had access to its network from January 14, 2025, to January 31, 2025.

A comprehensive review was conducted to determine whether patient data had been exposed, and on August 13, 2025, it was confirmed that sensitive patient data may have been accessed or acquired, including first and last names, addresses, state identification numbers/driver’s license numbers, medical information, and health insurance information. Network security has been strengthened, and additional cybersecurity measures have been implemented to prevent similar breaches in the future. Those measures include strengthened email filtering and malware monitoring, and additional cybersecurity awareness training is being provided to the workforce.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected. The Texas Attorney General was notified that 481 Texas residents were affected.

The post Almost 26,000 Individuals Affected by Data Breach at Methodist Homes of Alabama & Northwest Florida appeared first on The HIPAA Journal.

A data breach at the Fort Wayne Medical Education Program has affected almost 30,000 individuals. Data breaches have also been announced by Space Coast Vascular in Florida and Partners in Pediatrics in Colorado.

Fort Wayne Medical Education Program

Fort Wayne Medical Education Program, a family medicine residency in Northeastern Indiana, has recently announced a security incident that potentially involved unauthorized access to the personal and protected health information of up to 29,485 individuals, including patients, employees, and employees’ dependents.

Suspicious activity was identified within its computer network on December 17, 2024, and after securing its systems, the activity was investigated. The forensic investigation confirmed that an unauthorized actor had access to its computer network from December 12, 2024, to December 17, 2024, during which time files containing sensitive data may have been viewed or acquired. The file review was completed on September 9, 2025, when it was confirmed that personal and protected health information had been exposed.

The types of data involved vary from individual to individual. For employees and their dependents, the exposed data included first and last names, in combination with a Social Security number, driver’s license number, state ID number, or passport number. For patients, the exposed information includes names in combination with some or all of the following: Social Security number, government ID number such as driver’s license or passport number, date of birth, medical information, health insurance information, and medical billing information, which may have included bank account number and payment or credit card number (but not CVC). Notification letters were mailed to the affected individuals on October 2, 2025, and complimentary credit monitoring and identity protection services have been offered to individuals whose Social Security number was involved.

Space Coast Vascular

Space Coast Vascular, a vascular and venous health diagnostic laboratory and treatment center in Melbourne, Florida, has announced that it was the subject of a criminal cyberattack on or around January 13, 2025, that impacted its computer systems. Assisted by third-party cybersecurity experts, Space Coast Vascular learned on August 7, 2025, that patients’ protected health information had been exposed and may have been viewed or acquired by the threat actor.

The types of data involved vary from individual to individual and may include name, date of birth, Social Security number, driver’s license/state ID number, medical treatment information, health insurance information, and/or financial account information. At the time of issuing notifications, Space Coast Vascular was unaware of any misuse of patient data as a result of the incident.

The affected individuals are now being notified by mail, and at least 12 months of complimentary credit monitoring and related services are being offered.  Space Coast Vascular has also confirmed that a series of cybersecurity improvements have been made to reduce the risk of similar incidents in the future. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Partners in Pediatrics

Partners in Pediatrics, an integrative pediatric healthcare practice with offices in Denver and Englewood in Colorado, has recently notified patients about a recent email account breach. Suspicious activity was identified in an employee’s email account on March 5, 2025. The email account was secured, and digital forensics experts were engaged to investigate the activity. They determined that the threat actor had access to emails containing patient information; however, no other systems were affected. The emails were reviewed, and that process was completed on September 23, 2025. Information potentially compromised in the incident includes names, dates of birth, Social Security numbers, driver’s license numbers, clinical information, treatment information, lab test results, prescription information, provider information, and health insurance information.

Data privacy and security policies and procedures have been reviewed, and security measures have been enhanced to prevent similar incidents in the future. On October 3, 2025, individual notification letters started to be mailed to the affected individuals. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Fort Wayne Medical Education Program Data Breach Affects Almost 30,000 Individuals appeared first on The HIPAA Journal.