Gaylord Specialty Healthcare is notifying patients affected by a December hacking incident, and Gainwell Technologies has reported a breach involving the data of Medicaid recipients in Georgia.

Gaylord Specialty Healthcare, Connecticut

Gaylord Farm Association Inc., doing business as Gaylord Specialty Healthcare, a nonprofit medical rehabilitation center in Wallingford, Connecticut, has recently started notifying patients about a December 2024 security incident that potentially involved unauthorized access to patient information.

Suspicious activity was identified within its computer network on December 19, 2024, and the forensic investigation confirmed unauthorized access to its network from December 16 to December 19. Files were reviewed to determine the types of information involved and the individuals affected. On August 25, 2025, Gaylord learned that the impacted data included names, dates of birth, Social Security numbers, taxpayer ID numbers, driver’s license or state ID numbers, passport numbers, account numbers, routing numbers, payment card numbers, payment card CVVs, medical record numbers, mental or physical condition, treatment information, diagnoses and diagnosis codes, treatment locations, procedure types, provider names, treatment costs, medical date of services, admission/discharge dates, prescriptions, billing/claims information, health insurance information and/or patient account numbers.

Gaylord said it issued a provisional notice to the HHS’ Office for Civil Rights about the data breach and uploaded a breach notice to its website on February 28, 2025; however, the incident is not yet shown on the HHS’ data breach portal, which suggests the initial estimate indicated that fewer than 500 individuals were affected. Gaylord said the delay in issuing individual notifications was due to the complex and time-consuming review of the affected files, which required a manual review of thousands of documents. Security policies, procedures, and practices have been reviewed and enhanced to prevent similar breaches in the future. The total number of affected individuals is not currently known, although the breach was reported to the Maine Attorney General as affecting 75 Maine residents.

Gainwell Technologies, Virginia

Gainwell Technologies, a provider of technology solutions and software to healthcare organizations and government agencies, has recently announced a data breach affecting 912 Medicaid recipients in Georgia. Gainwell Technologies is the fiscal agent for Medicaid in the state, and contracts with Georgia’s Department of Community Health. According to a statement issued by the contractor, on July 23, 2025, an unauthorized caller requested access to payments to providers and gained access to a reimbursement account that contained patient information.

The account contained billing statements that included Medicaid recipients’ names, Medicaid ID numbers, coverage information, and payment information for the periods when services were received. Gainwell Technologies said it is unaware of any misuse of the affected data but has offered complimentary credit monitoring services to the affected individuals for a period of one year as a precaution.

The post Connecticut Medical Rehabilitation Center Announces Hacking Incident appeared first on The HIPAA Journal.

Healthcare Interactive Inc. has confirmed that data was exfiltrated in a July 2025 hacking incident. Data breaches have also been reported by the Health Department of the City of St. Joseph in Missouri and Viva Health in Alabama.

Healthcare Interactive (HCIactive)

Healthcare Interactive Inc., a provider of AI-powered software solutions for insurance enrollment and benefits administration, has recently announced a July 2025 hacking incident that involved the exfiltration of files from its network. Suspicious activity was identified within its computer network on or around July 22, 2025. An investigation was launched to identify the cause of the activity, which confirmed unauthorized access to its network and data exfiltration from its network between July 8, 2025, and July 12, 2025.

The review of the exposed files confirmed that they contained protected health information such as names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers, health insurance enrollment information, medical record numbers, diagnoses, lab results, prescriptions, and other care and treatment information, medical images, doctors’ names, and health insurance claims information.

While sensitive data was stolen, Healthcare Interactive said it is unaware of any misuse of that information; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Security policies and procedures are being reviewed, and additional safeguards are being implemented to better secure its systems and data. The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

City of St. Joseph Health Department, Missouri

The Health Department of the City of St. Joseph in Missouri experienced a hacking incident that caused network disruption on June 9, 2025. Third-party cybersecurity experts were engaged to investigate and determine the nature and scope of the activity. The investigation confirmed that there may have been unauthorized access to files containing patient data, and files may have been exfiltrated from the network.

Data mining experts were engaged to review the files, and on September 4, 2025, it was confirmed that 11,538 patients had been affected and had some of their protected health information exposed. The types of information involved vary from individual to individual and may include first and last names, dates of birth, driver’s license numbers/state identification numbers, passport numbers, Social Security numbers, and medical diagnosis and treatment information. The health department engaged cybersecurity experts to review its security practices and protocols, and enhancements have been made based on their recommendations.

Viva Health, Alabama

Viva Health, an Alabama-based health insurance company that works with the Alabama Medicaid agency, has identified an exposed file on its website that contained the protected health information of 4,945 of its members. The exposed file was identified on August 27, 2025, and the investigation confirmed that it was accessible via the website from June 14, 2025, to August 27, 2025. The file contained limited member information – Medicare numbers, member IDs, group numbers, county of residence, and authorization numbers from August and September 2024. The file did not include members’ names, nor highly sensitive information such as Social Security numbers or financial information. As a precaution against data misuse, members have been advised to monitor their Explanation of Benefits statements and have been offered one year of complimentary credit monitoring services.

The post Data Exfiltrated in Hacking Incident at Healthcare Interactive Inc. appeared first on The HIPAA Journal.

On September 22, 2025, Veradigm, a Chicago, Illinois-based provider of practice management and electronic health record solutions to healthcare providers (formerly Allscripts), started issuing notification letters about a July 2025 security incident that involved unauthorized access to customer data.

On July 1, 2025, Veradigm learned that an unauthorized third party had accessed one of its storage locations. Steps were immediately taken to block the unauthorized access, law enforcement was notified, and third-party digital forensics and cybersecurity experts were engaged to investigate the activity and mitigate any impact of the unauthorized access. The investigation determined that a data security incident at one of its customers resulted in credential theft that allowed access to a Veradigm storage account. The attacker used the credentials to access the storage account on or around December 2024. Veradigm learned about the unauthorized access through a third party that was investigating its customer’s security incident. The data breach was limited to the storage account, and no other systems or environments were affected. While data was exposed, Veradigm is unaware of any misuse of the exposed data.

The file review confirmed that the following types of information had been exposed: name, contact information, date of birth, health records information (diagnoses, medications, test results, and treatments), health insurance information, payment details, and limited identifiers, such as Social Security numbers and driver’s license numbers. The types of information involved vary from individual to individual. Veradigm has implemented additional technical safeguards to prevent similar incidents in the future and has offered the affected individuals complimentary credit monitoring and identity theft protection services.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected. The data breach affected several of its customers and is likely to be a significant data breach. At least 70,000 individuals have been confirmed as affected in two states alone, based on the breach reports submitted to the Texas and South Carolina state attorneys general. The California Attorney General has also been informed that state residents have been affected.

The post Veradigm Announces Data Breach Affecting Several Customers appeared first on The HIPAA Journal.

Cybersecurity researcher Jeremiah Fowler has found an exposed 23.7 GB database containing more than 145,000 files, such as PDFs, PNGs, and other image files. The database has been linked to the California home health and palliative care provider, Archer Health. Fowler analyzed a sample of the files and identified patient names, contact information, Social Security numbers, and patient ID numbers. The files included medical documents such as discharge summaries, which included health information such as conditions, diagnoses, admission and discharge dates, treatment information, care plan information, as well as assessments and home health certifications.

Many of the image files were screenshots of healthcare management software that showed active dashboards, logging, tracking, and scheduling details. Some of the folder names included patients’ first and last names – a bad security practice. As Fowler pointed out, personally identifiable information such as patient names can easily be exposed through error or monitoring logs. Fowler was able to link the database to Archer Health and notified the company about the exposed database, which was secured within hours and is no longer accessible. Archer Health thanked Fowler for bringing the matter to their attention and confirmed that an investigation had been launched, and any security issues that led to the exposure would be addressed.

It was not possible to tell how long the database was exposed, if it was accessed or copied by any unauthorized individuals, or whether the database was maintained by Archer Health or one of its vendors. Since only a sample of files was analyzed, it is unclear how many patients had their data exposed.

Mailing Error Impacts More Than 3,100 Arizonans

The Arizona Health Care Cost Containment System (AHCCCS), Arizona’s Medicaid agency, has notified 3,177 members about an impermissible disclosure of a limited amount of protected health information. On August 29, 2025, a mailing error was identified with a routine mailing regarding members’ health plan enrollment when a member called AHCCCS after receiving a misdirected letter.

The mailing was immediately halted, and an investigation was launched to determine the cause of the error, the individuals affected, and the information involved. The letters did not include any highly sensitive information, such as Social Security numbers, only a member’s name, AHCCCS identification number, and health plan name. In each case, the letters were sent to one incorrect recipient. HCCCS said it has conducted a review of its mailing processes and procedures and has taken steps to prevent similar mis-mailings in the future.

The post Security Researcher Identifies Exposed 150,000-record Home Health Care Database appeared first on The HIPAA Journal.

Data breaches have recently been announced by Coos County Family Health Services in New Hampshire, Roush Fenway Keselowski Racing in North Carolina, and the University of North Carolina at Chapel Hill/UNC School of Medicine.

Coos County Family Health Services

Coos County Family Health Services, a primary care provider based in Berlin, New Hampshire, has recently announced a privacy incident that was identified on July 9, 2025, when suspicious activity was observed in its servers and phone systems. An investigation was launched, which confirmed that an unauthorized third party had access to its servers and phone systems on July 9, 2025, and may have copied data from those systems.

While ransomware was not mentioned in the notification letters, this appears to have been a ransomware attack. A ransomware group called RunSomeWarez claimed responsibility for the attack and added Coos County Family Health Services to its dark web data leak site. The group claims to have exfiltrated data. A ransom does not appear to have been paid.

Coos County Family Health Services reviewed the affected files and confirmed that they contained patient information such as names, dates of birth, contact information, Social Security numbers, medical information, and medical identification numbers. While no evidence has been found to suggest any misuse of the exposed data, complimentary credit monitoring and identity theft protection services have been offered to the affected individuals as a precaution.  Security policies and procedures have also been reviewed and enhanced to prevent similar incidents in the future.

Roush Fenway Keselowski Racing

Roush Fenway Keselowski Racing has recently announced that it was the victim of a cyberattack that resulted in unauthorized access to systems containing the protected health information of employee health plan members. Suspicious activity was identified within its computer environment on May 14, 2025, and third-party digital forensics experts were engaged to investigate the activity. The investigation confirmed that files were either accessed or copied from its network.

The files were reviewed, and on August 4, 2025, Roush Fenway Keselowski Racing confirmed that health plan member information was exposed, including names, addresses, dates of birth, Social Security numbers, driver’s license/state identification card numbers, health insurance subscriber numbers, passport numbers, health information, financial account information, health insurance information, health insurance claim information, and medical information. Up to 2,160 individuals were affected and have been offered complimentary identity monitoring services.

The University of North Carolina at Chapel Hill – School of Medicine

The University of North Carolina at Chapel Hill and the University of North Carolina Hospitals have announced a breach of an email account of a UNC School of Medicine employee. The investigation revealed the email account was accessed by an unauthorized third party following a response to a phishing email. The attacker used social engineering techniques to trick the employee into clicking a malicious link and disclosing their account credentials. The email appeared to have been sent by a trusted source.

The breach was detected on July 24, 2025, and was remediated within 15 hours of the unauthorized access; however, during that time, the attacker potentially viewed or acquired the electronic protected health information of patients.  The potentially compromised information included names, dates of birth, diagnosis and treatment information, Social Security numbers, driver’s license numbers, financial information, health insurance information, and/or information about a research study that the individuals were involved in or eligible to participate in.

Notification letters were mailed to the affected individuals on September 19, 2025, and complimentary credit monitoring has been offered to individuals whose Social Security numbers, driver’s license numbers, financial information, and/or health insurance information were involved. The data breach was reported to the HHS Office for Civil Rights by the University of North Carolina at Chapel Hill – School of Medicine as affecting 799 individuals, and UNC Hospitals as affecting 6,377 individuals.

The post Cyberattack on Coos County Family Health Services Exposed Patient Data appeared first on The HIPAA Journal.

Albany Gastroenterology Consultants and Inlet Care (Communicare) are notifying patients affected by cyberattacks in November 2024 that involved unauthorized access to systems containing patient data.

Albany Gastroenterology Consultants

Albany Gastroenterology Consultants in New York State has notified the Maine Attorney General about a data breach involving the personal and protected health information of up to 57,751 individuals. Unusual network activity was identified on November 19, 2024, which disrupted access to one of its computer systems. Steps were taken to isolate the system, and an investigation was launched to determine the nature of the activity and whether any patient data had been compromised. The investigation confirmed unauthorized access to its network and that certain personal information was accessed and acquired by the threat actor on November 10, 2024.

While notification letters were mailed to some of the affected individuals on September 23, 2025; however, the data breach was first disclosed by Albany Gastroenterology Associates in January 2025. The first batch of notification letters was mailed on January 28, 2025, and stated that the review of the affected files concluded on January 21, 2025. According to the latest batch of notification letters, the file review was completed on September 17, 2025, indicating further individuals were found to have been affected. The letters state that names and Social Security numbers were involved. While data theft was confirmed, at the time of issuing notifications, Albany Gastroenterology Consultants was unaware of any misuse of the affected data. Steps have since been taken to enhance its security posture to reduce the risk of similar incidents in the future. Complimentary credit monitoring and identity theft protection services have been made available.

Inlet Care (Communicare)

Inlet Care, doing business as Communicare, a provider of behavioral health, developmental disabilities, and substance abuse services in Kentucky, has discovered unauthorized access to its computer network. Unusual activity was identified within its network on November 23, 2024. Steps were immediately taken to secure its systems, and an investigation was launched to determine the nature and scope of the activity. The investigation confirmed that an unauthorized third party had access to its network for a short period on November 23, and while the window of opportunity was short, files containing sensitive information of current and former employees, dependents, and other individuals were exfiltrated from the network.

The review of the affected files has recently been completed, and Communicate has confirmed that they contained names in combination with one or more of the following: Social Security number, date of birth, driver’s license number, state-issued identification number, passport number, military identification number, financial account information, medical information, and health insurance information. Security policies and procedures have been reviewed, and additional cybersecurity measures are being implemented to strengthen security. Notification letters are now being mailed to the affected individuals. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Albany Gastroenterology Consultants: November 2024 Data Breach Affects Almost 58,000 Patients appeared first on The HIPAA Journal.

ApolloMD Business Services, LLC (ApolloMD), an Atlanta, GA-based provider of integrated, multispecialty physician, APC, and practice management services, has recently disclosed a security incident affecting several of its physician practice clients.

Unusual activity was identified within the ApolloMD network environment on May 22, 2025. An investigation was launched to determine the nature and scope of the activity, and steps were taken to secure its network. Assisted by a third-party cybersecurity firm, ApolloMD learned that an unauthorized third party had access to its network from May 22, 2025, to May 23, 2025. During that time, files containing the electronic protected health information (ePHI) of ApolloMD’s affiliated physicians and practices may have been accessed or acquired.

The file review determined that the information potentially stolen in the incident included names, addresses, dates of birth, diagnoses, provider names, dates of service, treatment information, and health insurance information. A subset of individuals also had their Social Security numbers exposed. ApolloMD notified the affected physicians and practices between July 21, 2025, and September 11, 2025, and notification letters started to be mailed to the affected individuals on September 17, 2025. ApolloMD has confirmed that complimentary credit monitoring and identity theft protection services are being offered to individuals whose Social Security numbers were exposed.

ApolloMD did not disclose details about the nature of the attack; however, the Qilin ransomware group claimed responsibility and added ApolloMD to its dark web data leak site in June 2025. Qilin claimed to have exfiltrated a large amount of sensitive data and said it would release the data on June 16, 2025, if the ransom was not paid. At the time of writing, the Qilin data leak site is not accessible, and other sites operated by the group are protected by a login. Qilin has been the most active ransomware group in four of the five months up to August 2025, according to cybersecurity firm Cyble, having claimed more than twice the number of victims as the second most active group. It should be stated that ransomware groups have been known to fabricate claims on their data leak sites.

The total number of affected individuals has not been made public by ApolloMD at this stage, and the data breach is not currently shown on the HHS’ Office for Civil Rights website.

ApolloMD is issuing notification letters on behalf of the following covered entity clients.

• Passaic Hospitalist Services, LLC
• Passaic River Physicians, LLC
• Pensacola Hospitalist Physicians, LLC
• Broad River Physicians Group, LLC
• Olive Branch Emergency Physicians, LLC
• Aurora Emergency Physicians, LLC
• The Bortolazzo Group, LLC
• Methodist University Emergency Physicians, PLLC
• Trinity Emergency Physicians, LLC
• Lorain Emergency Physicians, LLC
• Pennsylvania Hospitalist Group, LLC

The post Business Associate ApolloMD Confirms Breach Affecting Multiple Physician Practices appeared first on The HIPAA Journal.

Sturgis Hospital, a rural critical access hospital in the Northern Black Hills in Michigan, has recently reported two security incidents to the HHS’ Office for Civil Rights, both of which have potentially affected up to 77,771 individuals. The first incident was identified in December 2024 when unauthorized activity was observed in part of its computer network. Third-party cybersecurity experts were engaged to investigate the incident and determine the nature and scope of the unauthorized activity. Unauthorized access was confirmed, the incident was remediated, and the exposed files were reviewed to determine the individuals affected and the types of data involved.

The investigation and file review had not concluded when further unauthorized network activity was detected in June 2025. A separate investigation was launched into the second incident, with assistance provided by third-party experts. Based on the two investigations, Sturgis Hospital concluded that there was potentially unauthorized access to patient and employee information and files containing sensitive patient and employee data may have been exfiltrated from its network.

The file review confirmed that the exposed information included names, contact information, government identification numbers such as Social Security numbers, financial account information, health insurance information, and clinical information, such as treatment information, prescriptions, and other medical information. Sturgis Hospital said it worked with third-party cybersecurity experts to secure its systems and implement additional cybersecurity measures to prevent similar incidents in the future. The affected individuals have been offered complimentary subscriptions to credit monitoring and identity theft protection services. Law enforcement was notified about both incidents, and while law enforcement did not request delaying notifications, it has taken some time to investigate the incidents. Notification letters are now being mailed to the affected individuals.

Only a few weeks ago, Aspire Rural Health System, another rural healthcare provider in Michigan, announced a cyberattack and data breach that affected up to 140,000 individuals, and Endless Mountains Health Systems in Montrose, Pennsylvania, experienced a suspected ransomware attack in March 2025. Many rural healthcare providers are struggling to remain viable, and in some cases are providing care well below the cost of providing their healthcare services. With limited funds available for cybersecurity and difficulties attracting skilled cybersecurity staff, they can be vulnerable to cyberattacks. The HHS has recently confirmed that $50 billion is being made available in grants to transform rural healthcare over the next five years, one of the goals of which is to help rural healthcare providers invest in technology and improve cybersecurity.

The post Michigan Critical Access Hospital Suffers Two Hacking Incidents Affecting Almost 78,000 Individuals appeared first on The HIPAA Journal.