From ClingantryAI Health Regulator News

Tarter Krinsky & Drogin LLP, a business associate based in New York, submitted a breach filing to HHS OCR on 09/15/2026. The incident involved a hacking/IT incident targeting a network server. The breach potentially exposed the protected health information of 196,645 individuals. As a business associate, this entity is responsible for reporting the incident to its covered entity partners, who must then report to HHS if required. Administrators should verify if their organization is one of the covered entities linked to this business associate to assess potential notification obligations for their patients.

A New York healthcare provider, Premier Medical Group of the Hudson Valley P.C., filed a report with HHS OCR on August 21, 2026, disclosing a significant security incident. The filing indicates that a hacking/IT incident compromised data stored on a network server, affecting approximately 282,075 individuals. This submission date marks when the report was sent to regulators, not necessarily when the breach occurred or was discovered. As a covered entity, the medical group is required to notify affected patients and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

New York City Health and Hospitals Corporation filed a breach notification with HHS OCR on March 24, 2026, reporting that a hacking/IT incident exposed the protected health information of 1.8 million individuals. The unauthorized access occurred on a network server. As a healthcare provider and covered entity, the organization is required to report breaches affecting 500 or more individuals to HHS within 60 days of discovery. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any potential impact on shared systems or business associates.

National Association on Drug Abuse Problems, a healthcare provider in New York, filed a breach report with HHS OCR on 02/13/2026. The incident involved a hacking/IT incident targeting a network server. The filing indicates that 90,000 individuals were affected. This submission date reflects when the report was sent to the government, not when the breach occurred. Healthcare administrators should review this filing to understand the scope of incidents involving similar provider types. The data was stored on a network server, highlighting the risks associated with centralized digital storage systems for protected health information.

A Business Associate named Fieldtex Products, Inc. in New York reported a hacking/IT incident affecting 238,615 individuals. The filing was submitted to HHS OCR on November 20, 2025. The breach involved data stored on a network server. As a Business Associate, Fieldtex handles protected health information on behalf of covered entities. If your organisation contracts with Fieldtex for services, you should verify whether your patient data was among the affected records and review your business associate agreement for notification obligations. This filing confirms the incident was reported to the regulator; it does not specify the exact date the breach occurred or was discovered.

Liberty Resources, Inc., a healthcare provider in New York, submitted a breach report to HHS OCR on March 4, 2025. The filing describes a hacking/IT incident that compromised data stored on a network server, affecting 103,711 individuals. As a covered entity, Liberty Resources must notify affected individuals and HHS OCR. This incident highlights the risk of server-based attacks for any organization handling protected health information. Healthcare administrators should review their own cybersecurity protocols to ensure network servers are secure against similar attacks.

A New York radiology group, University Diagnostic Medical Imaging, PC, filed a report with HHS OCR on January 21, 2025, disclosing a hacking/IT incident. The breach involved unauthorized access to a network server, exposing the protected health information of 138,080 individuals. As a healthcare provider, the entity is directly responsible for this disclosure. Administrators at imaging centers and hospitals should note the scale of this incident as a benchmark for risk assessment. While the filing date is January 21, 2025, this does not indicate when the breach occurred or was discovered. Monitor for further details on the nature of the data exposed.

A significant data breach has been reported involving ATSG, Inc., a business associate operating in New York. This incident, classified as a hacking/IT event, compromised the protected health information of 909,469 individuals. The breach occurred on a network server and was reported to the HHS Office for Civil Rights on October 4, 2024. Hospital administrators should review their own business associate agreements to ensure vendors have robust cybersecurity measures. While this specific incident affects ATSG, it serves as a stark reminder of the risks associated with third-party data handling. Monitor your own systems for unusual activity and verify that your partners are compliant with security standards.

Excelsior Orthopaedics, LLC, a healthcare provider in New York, reported a hacking/IT incident to HHS OCR on August 21, 2024. The filing indicates that 292,913 individuals were affected. The breach involved unauthorized access to a network server. While this submission date marks when the report was filed, it does not necessarily reflect when the incident occurred or was discovered. Healthcare administrators should review their own cybersecurity protocols, particularly regarding server security, to ensure patient data remains protected against similar threats.