On March 24, 2026, NYC Health + Hospitals Corporation announced that personally identifiable information (PII) and protected health information (PHI) were exposed in a data security incident. NYC Health + Hospitals identified suspicious activity within its computer network on February 2, 2026. Immediate action was taken to secure the affected systems, and an investigation was launched to determine the nature and scope of the unauthorized activity, with assistance provided by third-party cybersecurity specialists.

The investigation determined that an unauthorized third party first gained access to its network more than two months previously, on November 25, 2026, and retained access until February 11, 2026. The investigation into the incident is ongoing; however, NYC Health + Hospitals believes that initial access to its systems may have been gained in a security breach at one of its third-party vendors. The name of that vendor was not disclosed.

NYC Health + Hospitals determined that files were exfiltrated from its network, some of which contained PII and PHI. Over the past few weeks, NYC Health + Hospitals has been reviewing the impacted data to determine the types of information involved and the individuals affected by the incident. The delay in issuing notifications to the affected individuals was due to the time taken to review the affected data. There were no instructions from law enforcement to delay notifications.

Based on the results of the data review to date, the following types of data were compromised in the incident: names; medical information (medical record numbers, disability codes, diagnoses, medications, test results, images, treatment plans); health insurance information (plans/policies, insurance companies, member/group ID numbers, Medicaid-Medicare-government payor ID numbers), billing/claims information; biometric information; personal information (Social Security numbers, driver’s license numbers or other government-issued identification numbers, taxpayer identification numbers or IRS-issued identity protection numbers, precise geolocation data, credit or debit card numbers, financial account information or credentials, online account credentials). The information involved varies from individual to individual.

NYC Health + Hospitals said several steps have been taken to bolster security to prevent similar incidents in the future. They include enhanced detection rules for cybersecurity tools, password resets for compromised accounts, additional detection and protective technologies, and updates to remote access management policies. Credit monitoring and identity theft protection services have been offered to the affected employees and patients for 24 months.

The data breach has been reported to the appropriate authorities, but it has yet to appear on the HHS’ Office for Civil Rights breach portal, which currently shows no data breach reports since February 26, 2026. As such, it is currently unclear how many individuals have been affected.

The post NYC Health + Hospitals Discloses 11-week Network Compromise appeared first on The HIPAA Journal.

Evansville, Indiana-based Deaconess Health System has announced a data breach involving information shared with a third-party vendor, the MRO Corp-owned company MediCopy. Deaconess Health System is one of the largest health systems in the Illinois-Indiana-Kentucky tri-state area, and operates 18 hospitals in southwestern Indiana, western Kentucky, and southeastern Illinois. The data breach affects certain patients of two of its hospitals: Deaconess Henderson Hospital in Henderson, KY, and Deaconess Union County Hospital in Morganfield, KY.

Deaconess Health System contracted with MediCopy to handle release of information (ROI) requests. Deaconess Health System’s substitute breach notice explains that MediCopy informed the health system about the security incident on February 2, 2026. The investigation determined that an unauthorized actor accessed MediCopy-controlled/managed cloud-based file-sharing software on January 13, 2026, and downloaded files related to ROI requests. The security incident was limited to the cloud-based platform. There was no unauthorized access to any Deaconess Health System’s IT systems or electronic health record system. A spokesperson for MRO said neither the MRO platform nor MediCopy systems were compromised in the incident.

Deaconess Health System conducted a comprehensive review of the affected data and determined that the information compromised in the incident included names, dates of birth, dates of service, medical record numbers, Social Security numbers, health insurance information, and medical records related to the treatment received at Deaconess Health System hospitals.

Notification letters are being mailed to the affected individuals by Deaconess Health System, which is offering complimentary credit monitoring and identity theft protection services. Deaconess Health System has confirmed that additional measures have been implemented to further strengthen the security of its file-sharing platform and the information maintained on that platform.

The number of Deaconess Health System patients affected by the data breach has yet to be publicly disclosed. Deaconess Health System said it has reported the breach to the appropriate agencies,  but the breach is not yet shown on the HHS’ Office for Civil Rights breach portal. There has been a delay in adding data breaches to the OCR data breach portal. While there have been some additions of data breaches with reporting dates prior to February 26, 2026, the breach portal lists no new additions after that date (as of March 25, 2026).

The post Deaconess Health System Affected by Vendor Data Breach appeared first on The HIPAA Journal.

The sensitive data of more than 23,000 Florida Medicare members has been impermissibly shared with overseas companies, putting Medicare members’ sensitive health data at risk. The data was shared by Mirra Health, a provider of administrative services to health maintenance organizations (HMOs) in Florida.

Mirra Health had contracts with three HMOs in Florida: Secure Inc, Solis Health Plans Inc., and Ultimate Health Plans Inc. Under those contracts, Mirra Health agreed to provide certain administrative services, including member enrollment, claims adjudication and payment, utilization management, and grievance and appeals processing. Mirra Health engaged four unlicensed companies in India and the Philippines to perform claims processing and other functions and provided those companies with the necessary data to perform those functions.

While Mirra Health may choose to delegate certain functions to subcontractors, sensitive data was shared with unlicensed companies without the knowledge or prior approval of the HMOs or their enrollees. Under the terms of its contracts with the HMOs, prior authorization must be received before passing any data to offshore partners.

An investigation conducted by the Florida Office of Insurance Regulation determined that Mirra Health had engaged in business practices that pose an imminent threat to the public health, safety, and welfare of state residents. Mirra Health was found to have disclosed the sensitive data of 23,119 Florida Medicare Advantage enrollees to those unlicensed companies. The majority of the affected individuals participated in Chronic Condition Special Needs Plans (C-SNPs), Dual Eligible Special Needs Plans (D-SNPs), and Institutional Special Needs Plans (I-SNPs). When the Florida Office of Insurance Regulation requested that Mirra Health produce the contracts it had signed, it failed to produce all contracts with overseas companies, in violation of section 626.884 of the Florida Insurance Code.

This week, Florida Insurance Commissioner Michael Yaworsky suspended Mirra Health LLC’s certificate of authority. Yaworsky said the company demonstrated it is not competent or trustworthy, as it disclosed sensitive Medicare data to foreign entities that are beyond the regulatory reach of the Office of Insurance Regulation, depriving both the Office and the HMOs of the ability to protect vulnerable state residents.

The post Florida Insurance Commissioner Suspends Mirra Health for Medicare Data Transfers to Foreign Companies appeared first on The HIPAA Journal.

A major data breach has been reported by the telehealth platform provider OpenLoop Health Inc. While the total number of affected individuals has yet to be publicly disclosed, it could well be one of the largest healthcare data breaches of the year to date. According to the breach notice provided to the California Attorney General, OpenLoop Health learned on January 7, 2026, that an unauthorized third party had gained access to some of its systems and copied files containing sensitive data. Third-party cybersecurity specialists were engaged to investigate and determine the nature and scope of the incident and ensure that its systems were secured and could no longer be accessed.

The forensic investigation confirmed that the unauthorized third party had access to its network from January 7, 2026, to January 8, 2026, and the files exfiltrated from its systems included information such as names, addresses, email addresses, dates of birth, and medical information. OpenLoop Health said Social Security numbers were not accessed or stolen. Steps have since been taken to harden security, and the affected individuals are being notified by mail. Complimentary credit monitoring and identity theft protection services have been offered to the affected individuals.

A threat actor with the moniker Stuckin2019 claimed responsibility for the incident in a hacking forum listing and claims to have obtained the information of 1.6 million patients. Threat actor claims may be exaggerated, the records may not all be unique, and in some cases, the claims are entirely fabricated. In this case, Stuckin2019 published samples of patient data as proof of data theft. OpenLoop Health has yet to publicly confirm the scale of the data breach or the validity of Stuckin2019’s claims. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, although the website of the Office of the Texas Attorney General lists an OpenLoop Health data breach affecting 68,160 state residents. That incident was published by the Texas Attorney General on March 18, 2026.

Databreaches.net reports that the Stuckin2019 is male and an individual rather than a group, who seemingly has form attacking telehealth companies. He claimed earlier this year to have attacked the New York telehealth company Zealthy, although the company has yet to publicly disclose any data breach. Databreaches reports that the OpenLoop Health forum post was only live for two days before being taken down, and in conversation with the hacker on Tox, was informed that payment was received and the data had been deleted.

The post Telehealth Platform Provider OpenLoop Health Disclosed Data Breach appeared first on The HIPAA Journal.