From ClingantryAI Health Regulator News

A healthcare provider, Texas Tech University Health Sciences Center El Paso, filed a breach report with HHS OCR on November 25, 2024. The filing details a hacking/IT incident involving data stored on a network server. The breach potentially affected 815,000 individuals. As a covered entity, the university health sciences center is required to report such incidents. This filing date reflects when the report was submitted to the regulator, not necessarily when the breach occurred or was discovered. Healthcare administrators should note the scale of this incident as a benchmark for risk assessment in their own operations.

A healthcare provider, North Texas Behavioral Health Authority, filed a report with HHS OCR regarding a hacking/IT incident. The filing, submitted on March 6, 2026, indicates that 285,086 individuals were affected. The breach occurred on a network server. As a covered entity, the authority is required to notify affected individuals and report the incident to the government. Healthcare administrators should monitor for similar threats to their own network infrastructure and ensure their incident response plans are current.

Nacogdoches Memorial Hospital, a healthcare provider in Texas, filed a breach report with HHS OCR on March 30, 2026, regarding a hacking/IT incident. The OCR portal lists 2,507,073 individuals affected. While some secondary sources cite a lower figure of 257,073, the federal record stands at 2.5 million with no documented correction. The breach involved data stored on a network server. As a covered entity, the hospital is responsible for notifying affected individuals. Healthcare administrators should monitor official notifications from the hospital to understand the specific scope of exposure for their own patients or partners, as the federal filing does not detail the specific types of data compromised.

If you operate in Texas, there are two separate AI laws to know about, not one. The first, HB 149, is the broad rulebook for how AI systems can be used — it's been in effect since January 1, 2026. The second, SB 1188, is narrower but easy to overlook: it requires your staff to tell patients when AI was used in their diagnosis or treatment. That one has actually been in effect longer, since September 1, 2025. If your compliance team only checked the first law, you may already be missing a disclosure requirement that's been live for almost a year.