From ClingantryAI Health Regulator News

Healthcare organizations working with third-party vendors should note a recent breach reported by AngMar Management Services, a Business Associate based in Texas. The company submitted a breach filing to HHS OCR on September 16, 2026, indicating a Hacking/IT Incident that compromised a network server. This incident potentially exposed the protected health information of 126,196 individuals. As a Business Associate, AngMar Management Services is responsible for safeguarding patient data it handles on behalf of Covered Entities. This serves as a reminder for Covered Entities to ensure their Business Associate Agreements are robust and that vendors have strong security measures in place.

Tarter Krinsky & Drogin LLP, a business associate based in New York, submitted a breach filing to HHS OCR on 09/15/2026. The incident involved a hacking/IT incident targeting a network server. The breach potentially exposed the protected health information of 196,645 individuals. As a business associate, this entity is responsible for reporting the incident to its covered entity partners, who must then report to HHS if required. Administrators should verify if their organization is one of the covered entities linked to this business associate to assess potential notification obligations for their patients.

Healthcare organizations should note that **American Addiction Centers**, a **Business Associate** based in Tennessee, recently reported a significant **Hacking/IT Incident** to HHS OCR. This breach, submitted on **August 7, 2026**, impacted a **network server** and potentially exposed the protected health information of **327,754 individuals**. As a Business Associate, American Addiction Centers is responsible for safeguarding patient data under HIPAA, and this incident underscores the persistent cybersecurity risks faced by entities handling sensitive health information.

Aesto, LLC, a Business Associate based in Alabama, filed a breach report with HHS OCR on July 31, 2026. The filing covers a hacking/IT incident that compromised the protected health information of 9,540,683 individuals. The breach occurred on a network server. Because Aesto is a Business Associate, your organization may be affected if you use their services for administrative or technical support. Review your contracts and vendor risk assessments to determine if you are a client of Aesto. If you are, contact your vendor management team immediately to understand the specific data exposed and any required notification steps for your own patients or members.

CareCloud, Inc., a business associate based in New Jersey, reported a hacking/IT incident to HHS OCR on July 24, 2026. The breach affected 3,756,469 individuals, with data compromised on a network server. Because CareCloud is a business associate, any healthcare providers, health plans, or other covered entities that use its services may need to verify if their patient data was included in this incident. Organizations should review their contracts and communications from CareCloud to determine exposure. This filing date is when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered.

A Business Associate named Unlimited Technology Systems, LLC reported a hacking/IT incident to HHS OCR on July 21, 2026. The filing indicates that 3,803,750 individuals were affected. The unauthorized access occurred on a network server. Because the entity is a Business Associate, your organization may be impacted if you contract with this vendor for services involving protected health information. Review your vendor contracts and security logs to determine if you are among the affected clients. This submission date is when the report was filed, not necessarily when the breach occurred or was discovered.

Business Associate MCBS, LLC filed a breach report with HHS OCR for a hacking/IT incident. The filing, submitted on June 26, 2026, indicates that the data of 1,261,464 individuals was involved. The breach occurred on a network server. As a Business Associate, MCBS must notify the covered entities it serves. Healthcare organizations that contract with MCBS should verify if they are among the impacted entities and prepare for potential patient inquiries. This filing reflects the date the report was submitted to regulators, not necessarily when the incident occurred or was discovered.

A Florida-based business associate, Operation PAR, Inc., filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on June 25, 2026, indicates that 145,714 individuals were affected. The breach occurred on a network server. Because this entity is a business associate, its covered entities (such as health plans or providers) may need to verify their own notification obligations. Administrators should check if they contract with this vendor and review their business associate agreements for specific reporting requirements.

Aitkin County Health and Human Services, a Business Associate in Minnesota, submitted a breach report on 06/17/2026 for a hacking/IT incident involving 83,114 individuals. The compromised data was located in email systems. Because this entity acts as a Business Associate, its obligations differ from those of a Covered Entity. Administrators should verify whether their own contracts or vendor lists include this organization to determine if their data was part of this exposure. The submission date marks when the report was filed with HHS OCR, not when the incident occurred or was discovered. No further details on the scope of the email data are provided in the filing.

A business associate named Xsolis, Inc. filed a breach report with HHS OCR on June 5, 2026, disclosing a hacking/IT incident that compromised the data of 1,396,519 individuals. The unauthorized access occurred on a network server. Because Xsolis is a business associate, its clients—likely healthcare providers or health plans—may also have reporting obligations to their own patients or members. Administrators should verify if their organization uses Xsolis services and review internal protocols for handling third-party breach notifications. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered.

A North Carolina business associate, Networking Technology, Inc., reported a hacking/IT incident to HHS OCR on May 29, 2026. The filing indicates that 353,844 individuals were affected by the unauthorized access to data stored on a network server. Because the entity is a business associate, your organization may be indirectly impacted if you rely on their services for protected health information processing. Review your vendor contracts and incident response plans to ensure you are prepared for potential downstream notifications or service disruptions. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered.

GrayRobinson, P.A., a business associate based in Florida, submitted a breach filing to HHS OCR on 04/24/2026. The incident involved a hacking/IT incident targeting a network server. The breach impacts 54,131 individuals. Because GrayRobinson acts as a business associate, its obligations differ from those of a covered entity. Healthcare administrators should review their contracts with this vendor to ensure compliance. The filing date is the submission date, not the discovery date. No further details on the scope of data were provided in the source.

Navia Benefit Solutions, Inc., a Washington-based business associate for employee benefits (FSA, HSA, HRA, COBRA, DCAP), reported a hacking/IT incident to HHS OCR on March 18, 2026. The filing lists 2,151,330 individuals affected, but external reports from the Maine Attorney General and other sources cite a total of approximately 2,697,540 individuals. The breach involved data on a network server and other locations. Because Navia serves employers rather than hospitals, health plans, self-insured employers, and benefits administrators should verify if they use Navia. If so, review your vendor contracts and assess potential exposure to your members or employees. This filing date is when the report was submitted to OCR, not when the breach occurred.

OpenLoop Health, Inc., a business associate based in Iowa, reported a hacking/IT incident to HHS OCR on March 17, 2026. The filing indicates that 716,000 individuals were affected by the unauthorized access to data stored on a network server. Because OpenLoop Health is a business associate, your organization may be impacted if you use their services for administrative or clinical support. Review your contracts and communication channels to determine if this incident affects your operations or requires you to notify your own patients. The submission date reflects when the report was filed with the government, not necessarily when the breach occurred.

TriZetto Provider Solutions, a business associate serving healthcare providers, reported a hacking/IT incident to HHS OCR. The filing, submitted on February 6, 2026, states that 3,433,965 individuals were affected. The breach occurred on a network server. Because TriZetto is a business associate, your organization may be impacted if you use their services for claims processing or other administrative functions. Review your contracts and contact your vendor management team to confirm whether your entity is among those affected and to understand any required next steps.

Insightin Health, Inc., a business associate based in Maryland, filed a report with HHS OCR on January 16, 2026, disclosing a hacking/IT incident. The breach compromised the protected health information of 1,949,534 individuals. The unauthorized access occurred on a network server. Because Insightin Health is a business associate, your organization may be impacted if you contract with them for services such as claims processing or data analytics. Review your vendor contracts and assess whether you receive data from this entity. If so, contact your legal and compliance teams to determine if you need to notify your own patients or take additional risk mitigation steps.

Fieldtex Products, Inc., a Business Associate, filed an HHS OCR breach report on December 12, 2025, citing 104,071 individuals affected by a hacking/IT incident on a network server. This entry reflects the single OCR filing cited below; additional related filings have been reported elsewhere but are not covered by this record. If your organization uses Fieldtex services, review your contracts to understand notification obligations and monitor the OCR portal for further filings.

West Texas Health, PLLC, a business associate, reported a hacking/IT incident affecting 73,720 individuals. The breach involved unauthorized access to a network server. The filing was submitted to HHS OCR on 12/02/2025. This submission date reflects when the report was filed, not when the breach occurred or was discovered. As a business associate, West Texas Health has specific obligations under HIPAA. Covered entities working with this business associate should review their business associate agreements and ensure they are aware of this incident. Individuals affected may be notified by the entity. This entry highlights the importance of robust cybersecurity measures for all entities handling protected health information.

Persante Health Care, a business associate operating in New Jersey, filed a breach notification with HHS OCR on November 26, 2025. The filing reports a hacking/IT incident involving a network server that exposed the protected health information of 111,815 individuals. Because Persante is a business associate, this incident likely impacts the covered entities—such as hospitals, clinics, or health plans—that rely on its services. Healthcare administrators should check whether their organization uses Persante’s services and review any communications from the vendor regarding next steps for affected patients. The submission date reflects when the report was filed with regulators, not necessarily when the breach occurred or was discovered.

A Business Associate named Fieldtex Products, Inc. in New York reported a hacking/IT incident affecting 238,615 individuals. The filing was submitted to HHS OCR on November 20, 2025. The breach involved data stored on a network server. As a Business Associate, Fieldtex handles protected health information on behalf of covered entities. If your organisation contracts with Fieldtex for services, you should verify whether your patient data was among the affected records and review your business associate agreement for notification obligations. This filing confirms the incident was reported to the regulator; it does not specify the exact date the breach occurred or was discovered.

Business Associate Modernizing Medicine, Inc. filed a breach report with HHS OCR on October 17, 2025, describing a hacking/IT incident involving data on a network server. The filing covers 198,795 individuals. As a Business Associate, Modernizing Medicine provides services to covered entities; if your organisation uses their software, you should verify whether your patient data was among those affected. The submission date is when the report was filed with HHS, not necessarily when the breach occurred or was discovered. This is a reportable event under HIPAA breach notification rules.

A major breach has been reported involving Conduent Business Services LLC, a business associate operating in New Jersey. This incident, classified as a hacking/IT incident, compromised the data of approximately 62.2 million individuals. The unauthorized access occurred on a network server. Hospital administrators should verify if their organization uses Conduent for services such as billing, claims processing, or other administrative support. If you do, contact your vendor management team immediately to assess potential risks to your patient data. Even if you are not a direct client, the scale of this breach highlights the critical need to review your own cybersecurity protocols and ensure all business associates have robust security measures in place to protect sensitive health information.

A significant security incident has been reported by Philadelphia Corporation for Aging (PCA), a Business Associate operating in Pennsylvania. The organization filed a report with HHS OCR on September 23, 2025, disclosing a hacking/IT incident that compromised data stored on a network server. This breach affects a substantial number of individuals, with 410,491 people impacted. Because PCA is a Business Associate, this incident likely involves the health data of patients from various covered entities, such as clinics or health plans, that contract with them. Healthcare administrators should review their vendor contracts and security protocols to ensure their own Business Associates are maintaining adequate safeguards against cyber threats.

Veradigm LLC, a healthcare IT vendor classified as a Business Associate, reported a hacking/IT incident affecting 2,672,036 individuals. The HHS OCR record lists the submission date as September 22, 2025. Because Veradigm is a Business Associate, your organization’s obligations depend on your specific Business Associate Agreement and whether your patients’ data was involved. Review your contracts to understand liability and support responsibilities. Do not assume automatic notification duties; verify if your facility uses Veradigm services. Note that the related class action Goodrum v. Veradigm, Inc. has reached a final settlement. Payments for approved claims were issued on June 12, 2026, and uncashed checks void after September 10, 2026. Crucially, the OCR filing names Veradigm LLC, while the lawsuit names Veradigm, Inc.. These are distinct legal entities. Check your contracts for the exact legal entity name to ensure proper compliance.

Alera Group, Inc., a business associate in Illinois, reported a hacking/IT incident to HHS OCR on July 29, 2025. The breach involved unauthorized access to a network server, exposing the protected health information of 155,567 individuals. As a business associate, Alera Group is required to notify its covered entity clients, who in turn must notify affected patients. Healthcare administrators should verify if their organization contracts with Alera Group and review any notifications received. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Monitor communications from vendors to ensure compliance with notification timelines.

A Florida-based business associate, Zumpano Patricios, P.A., filed a report with HHS OCR regarding a hacking/IT incident. The breach affected 279,275 individuals, with unauthorized access occurring on a network server. The filing was submitted on July 3, 2025. As a business associate, this entity is bound by HIPAA obligations through its contracts with covered entities. Healthcare administrators should review their vendor contracts to ensure business associates have adequate security measures and breach notification protocols in place. This filing highlights the scale of potential exposure when network servers are compromised.

Cierant Corporation, a Business Associate based in Connecticut, filed a breach report with HHS OCR on July 3, 2025. The filing describes a hacking/IT incident involving a network server that exposed the protected health information of 232,506 individuals. Because Cierant is a Business Associate, this incident likely impacts the healthcare providers and health plans that contract with them. Your organisation should check whether you have a business relationship with Cierant Corporation. If you do, contact their compliance team immediately to understand the specific data involved and any required next steps for your own breach notification obligations.

Diversified Services Enterprises, a business associate in Florida, filed a report with HHS OCR on 06/13/2025 for a hacking/IT incident. The breach involves data from a network server and impacts 61,066 individuals. Because the entity is a business associate, covered entities that contract with them should review their Business Associate Agreements and monitor for any potential notification obligations to patients. The filing date is the submission date to HHS, not the date the breach occurred or was discovered. Administrators should verify if their organization is among those affected and ensure their vendor management processes are up to date.

Healthcare administrators using Episource, LLC for medical coding or risk-adjustment services should review their contracts and security protocols immediately. This Business Associate reported a hacking/IT incident to HHS OCR on June 6, 2025. The breach exposed the protected health information of 6,725,572 individuals stored on a network server. Because Episource acts as a vendor rather than a direct provider, your organization’s liability depends on your specific business associate agreement. Verify if your entity’s data was included in this massive exposure and confirm that Episource is providing required breach notifications to your patients if necessary.

A Florida-based business associate, DermCare Management, filed a report with HHS OCR on May 2, 2025, disclosing a significant security incident. The filing identifies a hacking/IT incident involving a network server that compromised the protected health information of 1,361,735 individuals. Because DermCare is a business associate, this breach likely impacts the healthcare providers and health plans that rely on its services. Administrators should verify if their organization contracts with DermCare and review their business associate agreements to understand notification obligations and risk mitigation steps. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered.

A filing for Absolute Dental Group, LLC in Nevada lists the entity as a Business Associate. The HHS OCR record, submitted on May 2, 2025, reports 1,223,635 individuals affected by a hacking/IT incident on a network server. A $3.3 million class action settlement received preliminary court approval on March 6, 2026. The Final Approval Hearing is set for Thursday, July 30, 2026, per the official settlement administrator site. (The court docket entry, Doc. 92, reads "Thursday, July 31" — July 31 is a Friday, and every other source gives July 30, so the docket appears to contain a clerical error.) If your organization contracts with this dental group, confirm the date with the settlement administrator.

Benefits administrator Endue Software filed a breach report with HHS OCR on April 11, 2025, disclosing a hacking/IT incident that exposed data for 118,028 individuals. As a Business Associate, Endue is required to notify its covered entity clients, who must then notify affected patients. The breach occurred on a network server. If your organisation contracts with Endue for claims processing or other services, verify whether you have received notification from them. If you are a covered entity, ensure you have protocols in place to receive and act on such vendor notifications promptly. This filing date reflects when the report was submitted to HHS, not necessarily when the incident occurred or was discovered.

A Maryland-based insurance group, Kelly & Associates Insurance Group, Inc., has filed a report with HHS OCR regarding a significant data breach. As a Business Associate, this entity handles protected health information on behalf of covered entities. The filing, submitted on April 9, 2025, indicates that a hacking/IT incident compromised data stored on a network server. The breach affects 553,332 individuals. Healthcare administrators should note this as a high-volume incident involving a vendor. While the submission date is April 9, the actual breach likely occurred earlier. This event highlights the risks associated with third-party data storage and the importance of monitoring vendor security practices.

A major Business Associate, Southeast Series of Lockton Companies, LLC (Lockton), reported a hacking/IT incident to HHS OCR on February 28, 2025. The filing states that 1,124,727 individuals were affected. The breach occurred on a network server. As a healthcare administrator, you must determine if your organization uses Lockton for services involving protected health information. If you do, this is a Business Associate breach that may require you to notify your patients or take other steps under HIPAA. Check your vendor contracts immediately to see if Lockton is a covered entity or business associate for your specific operations.

Primary Health-SMMPP, L.C., a business associate based in Arizona, submitted a breach report to HHS OCR on 02/06/2025. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 67,567 individuals were affected. This submission date reflects when the report was filed with the government, not when the breach occurred or was discovered. As a business associate, this entity has specific obligations under HIPAA regarding the protection of protected health information it handles on behalf of covered entities. Organizations working with this vendor should review their business associate agreements and ensure their own security protocols are robust against similar network threats.

A Business Associate serving addiction treatment providers, American Addiction Centers, Inc., filed a report with HHS OCR on November 25, 2024, disclosing a hacking/IT incident. The breach impacted 410,747 individuals, with protected health information accessed from a network server. Because American Addiction Centers acts as a Business Associate, the covered entities it serves—such as clinics and hospitals—may also have notification obligations to their own patients. Healthcare administrators should verify if their organization uses this vendor and review internal breach response protocols. This filing date reflects when the report was submitted to the government, not necessarily when the incident occurred or was discovered.

ESHA, Inc., a business associate based in Texas, submitted a breach report to HHS OCR on 11/15/2024. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 76,922 individuals were affected. Because ESHA is a business associate, its obligations differ from those of a covered entity. Administrators should review their contracts with ESHA and other vendors to ensure adequate safeguards are in place. This submission date reflects when the report was filed, not necessarily when the breach occurred.

RRCA Accounts Management Inc., an Illinois-based business associate, filed a report with HHS OCR on October 18, 2024, regarding a hacking/IT incident. The breach affected 115,837 individuals. The unauthorized access occurred on a desktop computer and a network server. As a business associate, RRCA handles protected health information on behalf of covered entities. If your organization contracts with RRCA for claims processing or similar services, review your business associate agreements and verify that you have received the required breach notification. This filing confirms the incident was reported to the federal regulator, but it does not specify the exact dates the data was compromised.

If your organisation uses Ciox Health LLC (doing business as Datavant Group) for data services, you may be affected by a significant security incident. This Business Associate reported a hacking/IT incident to HHS OCR on 10/07/2024. The filing lists 320,702 individuals affected. Protected health information was exposed via email. Because Datavant is a Business Associate, your own compliance obligations depend on your specific contract and data flow. Verify if you share data with this entity and review your Business Associate Agreement for notification requirements.

A significant data breach has been reported involving ATSG, Inc., a business associate operating in New York. This incident, classified as a hacking/IT event, compromised the protected health information of 909,469 individuals. The breach occurred on a network server and was reported to the HHS Office for Civil Rights on October 4, 2024. Hospital administrators should review their own business associate agreements to ensure vendors have robust cybersecurity measures. While this specific incident affects ATSG, it serves as a stark reminder of the risks associated with third-party data handling. Monitor your own systems for unusual activity and verify that your partners are compliant with security standards.

A Business Associate in Oklahoma, the Muskogee City County Enhanced 911 Trust Authority, filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on September 20, 2024, indicates that protected health information for 180,000 individuals was compromised. The breach occurred on a network server. As a Business Associate, this entity handles data on behalf of covered entities, meaning your organization may have been impacted if you contract with this authority for emergency services or related data processing. Review your vendor contracts and risk assessments to determine if this incident affects your own compliance obligations or patient notification requirements.

A Texas-based business associate, VeriSource Services, Inc., filed a report with HHS OCR regarding a hacking/IT incident that compromised the data of 112,726 individuals. The breach involved unauthorized access to a network server. This filing was submitted on August 20, 2024, which is the date the report reached the regulator, not necessarily when the incident occurred or was discovered. Because VeriSource is a business associate, its clients—likely healthcare providers or health plans—may also have obligations to notify their own patients depending on the specific services provided. Administrators should check if their organization contracts with this vendor and review existing breach notification protocols.

A business associate named Kerber, Eck & Braeckel LLP filed a breach report with HHS OCR on August 16, 2024. The filing covers a hacking/IT incident that compromised data for 134,918 individuals. The breached information was located on a network server. Because this entity is a business associate, your organization may be affected if you contract with them for services handling protected health information. Review your vendor contracts and security logs to determine if you are among the impacted covered entities. This submission date reflects when the report was filed with HHS, not necessarily when the breach occurred or was discovered.

A significant hacking/IT incident has been reported involving Specialty Networks, Inc., a business associate located in Tennessee. The breach affected the personal health information of 411,037 individuals. The compromised data was stored on a network server. This incident was reported to the HHS Office for Civil Rights on August 15, 2024. Hospital administrators should review their contracts with business associates to ensure robust cybersecurity measures are in place. If your facility uses Specialty Networks, verify their security protocols and confirm that any shared data was protected. This is a confirmed breach, not a proposal, highlighting the ongoing risks of digital health records.

HealthEquity, Inc., a Business Associate based in Utah, filed a report with HHS OCR on August 9, 2024, disclosing a hacking/IT incident. The breach impacted the protected health information of 4.3 million individuals. The compromised data was located on a network server. Because HealthEquity is a Business Associate, your organization may be affected if you use its services for health savings accounts or related benefits administration. Review your contracts and incident response plans to understand your obligations when a vendor experiences a security incident. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred.

Change Healthcare, a major business associate serving the healthcare industry, filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on July 19, 2024, indicates that the personal information of 192.7 million individuals was compromised. The breach occurred on a network server. Because Change Healthcare acts as a business associate, this incident likely impacts the many covered entities—hospitals, clinics, and health plans—that rely on its services. Administrators should verify if their organization uses Change Healthcare and review any communications regarding patient notification or remediation steps. This is a submission date, not necessarily the date the breach occurred.