Treasure Coast Hospice, a palliative care provider in Florida, and Harbor, a mental health and addiction treatment service provider in Ohio, have recently announced security incidents that have exposed patient data.
Health & Palliative Services of the Treasure Coast (Treasure Coast Hospice), Florida
Health & Palliative Services of the Treasure Coast, Inc. d/b/a Treasure Coast Hospice, a provider of palliative care and hospice services to residents of Martin, St. Lucie, and Okeechobee counties in Florida, has recently notified 13,234 individuals about a September 2024 security incident. On September 25, 2025, Treasure Coast Hospice was made aware of unusual activity within its email environment. A third-party cybersecurity firm was engaged to investigate the activity and confirmed unauthorized access to an email account that contained patient information.
The account was reviewed, and on July 15, 2025, the data mining process was completed, and it was confirmed that a range of information had been exposed and may have been accessed or copied. The types of information involved vary from individual to individual and may include names in combination with one or more of the following: date of birth, demographic information, Social Security number, driver’s license number, medical information, financial information, and health insurance information.
At the time of issuing notification letters, Treasure Coast Hospice was unaware of any misuse of the exposed information; however, as a precaution against identity theft and fraud, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Treasure Coast Hospice said it strongly encourages the affected individuals to take advantage of the services being offered. Additional security measures have been implemented to harden email security, weekly security scans will be conducted, and additional training is being provided to its workforce.
Harbor, Ohio
Harbor, a mental health and substance use disorder treatment provider in Ohio, confirmed in a September 30, 2025, press release that an unauthorized third party breached its security defenses and gained access to its computer network. Suspicious activity was identified on August 1, 2025, and an investigation was launched to determine the nature and scope of the unauthorized activity.
The investigation determined that an unauthorized third party had access to its computer network between July 25, 2025, and August 1, 2025, during which time files were exfiltrated from its network. The types of information in the files vary from individual to individual, and may include names, addresses, birth dates, Social Security numbers, driver’s license numbers/state identification numbers, diagnoses, treatment information, clinical information, financial account information, and health insurance information. Harbor is reviewing its security policies and procedures and will take steps to improve privacy and security. The incident is not yet shown on the HHS’ Office for Civil Rights website, so it is currently unclear how many individuals have been affected.
The post Data Breaches Announced by Treasure Coast Hospice & Harbor appeared first on The HIPAA Journal.