From ClingantryAI Health Regulator News

Healthcare administrators should note that Clover Health, a health plan operating in Minnesota, recently reported a significant data breach to HHS OCR. The incident, classified as a Hacking/IT Incident, affected 138,677 individuals. The breach involved information stored on a network server and other locations. This filing, submitted on September 14, 2026, highlights the ongoing cybersecurity risks faced by health plans and other healthcare entities. Organizations should review their own security protocols to protect patient data from similar threats.

Midwest Spine & Brain Institute, a healthcare provider in Minnesota, submitted a breach report to HHS OCR on August 14, 2026. The filing states that 108,487 individuals were affected by unauthorized access or disclosure of protected health information. The compromised data was located on a network server and other systems. This date reflects when the report was filed with the regulator, not when the incident occurred or was discovered. While secondary sources suggest the incident involved a vendor, 3C Care Systems, the official government record does not specify the cause or origin of the breach. Healthcare administrators should review this filing as an example of large-scale unauthorized access reporting.

Oakdale Ear Nose & Throat PA, a healthcare provider in Minnesota, filed a reportable breach notice with HHS OCR on 08/12/2026. The incident involved a hacking/IT incident that compromised patient information accessed via email. The filing indicates that 99,714 individuals were affected by this unauthorized access. This submission date reflects when the breach was reported to federal regulators, not necessarily when the intrusion occurred or was discovered. Healthcare administrators in Minnesota should review their email security protocols and incident response plans, as this case highlights the scale of risk associated with email-based data exposure for medical practices.

Aitkin County Health and Human Services, a Business Associate in Minnesota, submitted a breach report on 06/17/2026 for a hacking/IT incident involving 83,114 individuals. The compromised data was located in email systems. Because this entity acts as a Business Associate, its obligations differ from those of a Covered Entity. Administrators should verify whether their own contracts or vendor lists include this organization to determine if their data was part of this exposure. The submission date marks when the report was filed with HHS OCR, not when the incident occurred or was discovered. No further details on the scope of the email data are provided in the filing.

Minnesota Epilepsy Group, a single-specialty outpatient practice, reported a hacking incident affecting 80,061 patients on June 5, 2026. The takeaway for any smaller or specialty practice: attackers aren't only targeting big hospital networks or national insurers. If your organization is smaller, that is not protection — you're still a target, and this-size breach is common.

The Minnesota Department of Human Services, a state health plan, filed a breach report with HHS OCR on January 16, 2026. The filing covers 303,965 individuals and cites unauthorized access or disclosure of data stored on a network server. Healthcare administrators should note that this is a reportable breach involving a large number of people. The record does not specify whether the access was external or internal, only that it was unauthorized. Monitor for further updates from the agency regarding remediation steps or additional notifications.