From ClingantryAI Health Regulator News

Osceola Mental Health Inc. (dba Park Place Behavioral Healthcare), a healthcare provider in Florida, filed a breach report with HHS OCR on 08/26/2026. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 71,702 individuals were affected. This submission date reflects when the report was sent to the regulator, not when the breach occurred. Healthcare administrators in Florida should review their own cybersecurity controls, particularly for network servers, to ensure adequate protection against similar unauthorized access events.

A Florida-based business associate, Operation PAR, Inc., filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on June 25, 2026, indicates that 145,714 individuals were affected. The breach occurred on a network server. Because this entity is a business associate, its covered entities (such as health plans or providers) may need to verify their own notification obligations. Administrators should check if they contract with this vendor and review their business associate agreements for specific reporting requirements.

Mid Florida Dermatology & Plastic Surgery, a healthcare provider in Florida, submitted a breach report to HHS OCR on 05/01/2026. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 85,585 individuals were affected. This submission date reflects when the report was filed with the government, not necessarily when the breach occurred or was discovered. Healthcare administrators in Florida should review their own security controls against similar network server vulnerabilities. This entry concerns a covered entity; business associates serving this provider should ensure their own incident response plans align with these findings.

GrayRobinson, P.A., a business associate based in Florida, submitted a breach filing to HHS OCR on 04/24/2026. The incident involved a hacking/IT incident targeting a network server. The breach impacts 54,131 individuals. Because GrayRobinson acts as a business associate, its obligations differ from those of a covered entity. Healthcare administrators should review their contracts with this vendor to ensure compliance. The filing date is the submission date, not the discovery date. No further details on the scope of data were provided in the source.

A Florida healthcare provider, Wound Technology Network, Inc., filed a breach report with HHS OCR on January 28, 2026. The filing details a hacking/IT incident that compromised the protected health information of 139,830 individuals. The unauthorized access occurred on a network server. As a covered entity, the provider is required to report breaches affecting 500 or more individuals within 60 days of discovery. This submission date reflects when the report was filed with the government, not necessarily when the breach occurred. Healthcare administrators should monitor such filings to understand the evolving threat landscape, particularly for providers managing sensitive wound care data. No further details on the specific nature of the data accessed or the timeline of the incident are provided in this summary.

Brevard Skin and Cancer Center, a healthcare provider in Florida, submitted a breach report to HHS OCR on 12/12/2025. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 54,570 individuals were affected. This submission date reflects when the report was filed with the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators in Florida should review this filing to understand the scope of potential exposure in their region and ensure their own security controls against similar network-based threats are robust.

A major hacking/IT incident at VITAS Hospice Services, LLC, a healthcare provider in Florida, has been reported to HHS OCR. The filing, submitted on November 24, 2025, indicates that the personal information of 319,177 individuals was compromised. The breach originated from a network server. As a covered entity, VITAS is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor for further details regarding the specific data types exposed, as this large-scale incident highlights the ongoing risks to provider networks.

Business Associate Modernizing Medicine, Inc. filed a breach report with HHS OCR on October 17, 2025, describing a hacking/IT incident involving data on a network server. The filing covers 198,795 individuals. As a Business Associate, Modernizing Medicine provides services to covered entities; if your organisation uses their software, you should verify whether your patient data was among those affected. The submission date is when the report was filed with HHS, not necessarily when the breach occurred or was discovered. This is a reportable event under HIPAA breach notification rules.

A Florida healthcare provider, Medical Associates of Brevard, LLC, has filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on September 5, 2025, indicates that the personal information of 246,711 individuals was compromised. The breach occurred on a network server. As a covered entity, this provider is required to notify affected individuals and the Department of Health and Human Services. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

A healthcare provider, Retina Group of Florida, filed a breach report with HHS OCR on September 3, 2025. The filing describes a hacking/IT incident that compromised data stored on a network server. The breach affected 152,691 individuals. This submission date is when the report was filed with the regulator, not necessarily when the incident occurred or was discovered. As a healthcare provider, this entity is a Covered Entity under HIPAA. Administrators at other organizations should note the scale of this incident involving a specialist group. Review your own incident response plans to ensure they address server-level compromises. Monitor for further details from the provider regarding the specific types of data exposed.

A Florida-based radiology provider, Vital Imaging Medical Diagnostic Centers, LLC, filed a breach notification with HHS OCR on August 21, 2025. The filing reports a hacking/IT incident involving data stored on a network server. The breach potentially affected 111,509 individuals. As a covered entity, Vital Imaging is required to report this incident. Healthcare administrators should monitor for further details regarding the specific data elements compromised and any subsequent notifications to affected patients or regulators.

A Florida-based healthcare provider, MRI Associates of St. Pete, Inc. d/b/a Saint Pete MRI, filed a breach report with HHS OCR on August 19, 2025. The filing describes a hacking/IT incident involving a network server. The breach potentially affected 138,209 individuals. As a covered entity, the provider is required to notify affected patients and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

CPAP Medical Supplies and Services Inc., a healthcare provider in Florida, submitted a breach filing to HHS OCR on 08/15/2025. The incident involved a hacking/IT incident affecting 90,133 individuals. The breached information was located on a network server. This submission date reflects when the report was filed, not when the breach occurred. Administrators in Florida should review this filing for context on local provider risks. No further details were provided in the web description.

A Florida-based business associate, Zumpano Patricios, P.A., filed a report with HHS OCR regarding a hacking/IT incident. The breach affected 279,275 individuals, with unauthorized access occurring on a network server. The filing was submitted on July 3, 2025. As a business associate, this entity is bound by HIPAA obligations through its contracts with covered entities. Healthcare administrators should review their vendor contracts to ensure business associates have adequate security measures and breach notification protocols in place. This filing highlights the scale of potential exposure when network servers are compromised.

Diversified Services Enterprises, a business associate in Florida, filed a report with HHS OCR on 06/13/2025 for a hacking/IT incident. The breach involves data from a network server and impacts 61,066 individuals. Because the entity is a business associate, covered entities that contract with them should review their Business Associate Agreements and monitor for any potential notification obligations to patients. The filing date is the submission date to HHS, not the date the breach occurred or was discovered. Administrators should verify if their organization is among those affected and ensure their vendor management processes are up to date.

A Florida-based business associate, DermCare Management, filed a report with HHS OCR on May 2, 2025, disclosing a significant security incident. The filing identifies a hacking/IT incident involving a network server that compromised the protected health information of 1,361,735 individuals. Because DermCare is a business associate, this breach likely impacts the healthcare providers and health plans that rely on its services. Administrators should verify if their organization contracts with DermCare and review their business associate agreements to understand notification obligations and risk mitigation steps. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered.

Escambia Community Clinics, Inc., operating as Community Health Northwest Florida, filed a breach report with HHS OCR on February 3, 2025. The healthcare provider disclosed that a hacking/IT incident compromised data stored on a network server. The filing indicates that 143,969 individuals were affected by this unauthorized access. As a covered entity, the clinic is required to report breaches of this scale. Administrators at similar community health centers and clinics should review their own server security protocols and incident response plans, noting that submission dates reflect when the report was filed, not necessarily when the breach occurred or was discovered.