Photon Health; Healthcare Highways Announce Data Security Incidents

Posted by Steve Alder

Data breaches have been announced by the New York-based healthcare technology company Photon Health, the Texas-based medical provider network company Healthcare Highways, and the New York-based home health agency Any-Time Home Care.

Photon Health

Photon Health, a Brooklyn, New York-based healthcare technology company that operates a prescription network, has disclosed a cybersecurity incident involving unauthorized access to patient data. Photon Health learned on August 21, 2026, that a previously unknown security flaw in a self-hosted third-party application called Metabase had been exploited.

Metabase was used by Photon Health for business intelligence, product metrics, and customer dashboards. The threat actor exploited the zero-day vulnerability and gained access to stored data, which was potentially exfiltrated. Photon Health completed its data review on September 4, 2026, when it was confirmed that data compromised in the incident included names, addresses, phone numbers, birth dates, and prescription information. Notification letters started to be mailed to the affected individuals on October 8, 2026. At the time of issuing notification letters, Photon Health was unaware of any misuse of the impacted data. The Direwolf ransomware and data extortion group claimed responsibility for the attack.

The company has not yet publicly disclosed how many of its clients have been affected or the total number of individuals who had their data exposed in the incident, but has confirmed that complimentary credit monitoring and identity theft protection services have been offered to the affected individuals. Photon Health also confirmed that it is reviewing its cybersecurity measures and is taking steps to prevent similar incidents in the future.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Healthcare Highways

Healthcare Highways, a Frisco, Texas-based medical provider network company and health plan administrator, has recently disclosed a cybersecurity incident that was first identified on August 4, 2026. An investigation was launched to determine the nature and scope of the activity, which confirmed that an unauthorized third party had access to its network between July 22, 2026, and July 27, 2026. During that time, the protected health information of certain individuals was accessed and acquired.

The review of the affected data is ongoing; however, it has been determined that the types of data compromised in the incident include names, addresses, dates of birth, dates of service, Social Security numbers, patient ID numbers, procedure codes and costs, procedure/provider information, diagnoses, claims information, health insurance information, and information related to payment for healthcare services.

Healthcare Highways has yet to publicly disclose the total number of individuals affected by the incident. While the group behind the attack was not disclosed, the Chaos ransomware group claimed responsibility and says it exfiltrated 235 GB of data.

Any-Time Home Care

The New York-based home health agency Any-Time Home Care has recently disclosed a ransomware attack that was identified in March 2026. The forensic investigation determined that an unauthorized third party first accessed its network on or around March 17, 2026, and encrypted files. Files on the compromised parts of its network have been reviewed and found to contain names, addresses, birth dates, health information, and Social Security numbers. In total, 30,017 individuals have been affected by the incident. The affected individuals have been offered 24 months of complimentary credit monitoring and identity theft protection services.

The post Photon Health; Healthcare Highways Announce Data Security Incidents appeared first on The HIPAA Journal.

Roseland Community Hospital Association Settles Data Breach Lawsuit for $650,000

Posted by Steve Alder

Roseland Community Hospital Association in Illinois has agreed to settle a class action data breach lawsuit for $650,000. The lawsuit was filed in response to a 2024 cybersecurity incident that exposed sensitive patient and employee information. The attack was detected on June 2, 2024, and the investigation determined that names, dates of birth, addresses, medical record numbers, patient account numbers, health insurance information, diagnoses, and treatment information were present in the exposed data.

The data breach was reported to the HHS’ Office for Civil Rights using an estimate of at least 500 affected individuals, as required by the HIPAA Breach Notification Rule; however, that total has not been updated since the initial report, even though the data breach was far more extensive. According to court documents, the personal and protected health information of 101,354 individuals was potentially compromised in the incident. The affected individuals started to be notified on August 1, 2024.

On November 25, 2024, a class action lawsuit was filed by plaintiff Steven Hall in the Circuit Court of Cook County, Illinois, individually and on behalf of his three minor children. The lawsuit was consolidated with two further complaints as they had overlapping claims and classes. The plaintiffs alleged that the defendant was at fault, as reasonable cybersecurity measures had not been implemented as required by HIPAA, including but not limited to data encryption and logging, monitoring, and alerting tools. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, breach of bailment, invasion of privacy/disclosure of private information, and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act.

The defendant maintains there was no wrongdoing and filed a motion to dismiss, which was granted in part and denied in part. The consolidated lawsuit – Hall, et al. v. Roseland Community Hospital Association – is pending in the Circuit Court of Cook County, Illinois. The parties engaged in settlement discussions and negotiated a settlement to avoid the costs and risks associated with protracted litigation. The settlement has recently received preliminary approval from the court.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Under the terms of the settlement, Roseland Community Hospital Association has agreed to pay $650,000 to settle the lawsuit, inclusive of attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and benefits for the class members. Class members may claim one year of medical data monitoring services, reimbursement of documented losses due to the data breach up to a maximum of $5,000 per class member, and a pro rata cash payment, estimated to be $50 per class member. The cash payments are subject to a pro rata adjustment based on the number of claims received.

The deadline for objection and opting out is December 1, 2026. Claims must be submitted by December 31, 2026, and the final fairness hearing has been scheduled for January 6, 2027.

The post Roseland Community Hospital Association Settles Data Breach Lawsuit for $650,000 appeared first on The HIPAA Journal.

Secure Healthcare Information Management; Desert Orthopaedic Center Report Data Breaches

Posted by Steve Alder

Data breaches have been announced by the Pennsylvania-based medical management and billing service provider Secure Healthcare Information Management and Desert Orthopaedic Center in Nevada.

Secure Healthcare Information Management

The Allentown, Pennsylvania-based medical management and billing service provider, Secure Healthcare Information Management, LLC, has announced a recent security incident that may have resulted in unauthorized access to patients’ personal and protected health information.

According to its website breach notice, a network disruption was experienced on July 17, 2026. Action was immediately taken to secure its network, and an investigation was launched to determine the cause of the disruption. The investigation determined that its network was accessed by an unauthorized third party between July 6, 2026, and July 16, 2026. The review of the exposed data concluded on September 18, 2026, confirming that patient information such as names, birth dates, Social Security numbers, driver’s license numbers, medical information, and health insurance information was exposed and potentially acquired.

The affected individuals started to be notified on October 6, 2026, and complimentary identity protection services are being offered. The HHS’ Office for Civil Rights has been informed; however, the incident is not yet shown on the OCR breach portal, so it is currently unclear how many individuals have been affected.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Desert Orthopaedic Center

Desert Orthopaedic Center, an orthopedic medical group with five locations in Las Vegas and Henderson, Nevada, is notifying certain patients about a data security incident that may have resulted in patients’ personal and protected health information being accessed and acquired by an unauthorized third party.

The unauthorized access was detected on or around August 7, 2026, and the data review determined that the impacted information included names, contact information, dates of birth, Social Security numbers, treatment/diagnosis information, prescription/medication information, dates of service, provider names and locations, medical record numbers, patient account numbers, Medicare/Medicaid ID numbers, health insurance information, and/or medical billing/claims information.

Notification letters started to be mailed to the affected individuals in early October, and complimentary credit monitoring and identity theft protection services have been made available. The incident is not yet shown on the HHS Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Secure Healthcare Information Management; Desert Orthopaedic Center Report Data Breaches appeared first on The HIPAA Journal.