On April 21, 2026, three United States healthcare organizations—Southern Illinois Dermatology, Saint Anthony Hospital, and the North Texas Behavioral Health Authority—officially disclosed data security incidents that collectively compromised the personal and protected health information of nearly 600,000 individuals. These disclosures, filed with the U.S. Department of Health and Human Services Office for Civil Rights, highlight ongoing vulnerabilities within the healthcare sector's digital infrastructure and third-party supply chains.
Southern Illinois Dermatology reported a breach affecting 150,000 individuals. The organization identified unauthorized access to a network server that contained sensitive patient files. According to the disclosure, the breach was discovered during a routine security review, which revealed that an external actor had bypassed authentication protocols to access the system. The compromised data included patient names, residential addresses, dates of birth, and Social Security numbers. In response to the incident, the practice has implemented multi-factor authentication across all remote access points and engaged a third-party cybersecurity firm to conduct a comprehensive forensic analysis and system hardening.
Saint Anthony Hospital, a community-focused healthcare provider in Chicago, disclosed a ransomware incident that compromised the data of 212,000 patients. The hospital stated that the attack targeted administrative and billing systems, resulting in the encryption of certain data volumes. While the hospital’s clinical operations and electronic health record systems remained isolated and operational, the attackers exfiltrated files containing patient account details, insurance information, and limited clinical notes. Saint Anthony Hospital has refused to engage in ransom negotiations and is currently working with the Federal Bureau of Investigation to investigate the source of the attack. The hospital has begun the process of notifying affected parties and is providing 12 months of identity monitoring services.
The North Texas Behavioral Health Authority (NTBHA) reported the largest impact of the three, with 238,000 individuals affected. The breach was attributed to a security flaw in a third-party data management platform used by the authority for patient outreach. NTBHA stated that the vulnerability allowed for the unauthorized extraction of demographic data and internal service identifiers. Upon discovery, the authority suspended the vendor's access to its internal systems and initiated a migration to a new, high-security data environment. The authority confirmed that no financial information or Social Security numbers were compromised in this specific incident, though names and service dates were exposed.
All three organizations are complying with the HIPAA Breach Notification Rule, which requires notification to affected individuals and the Secretary of Health and Human Services within 60 days of discovery. These incidents highlight the ongoing risks associated with both direct network intrusions and the security posture of external service providers within the healthcare ecosystem. The organizations have stated they are reviewing their cybersecurity insurance policies and internal protocols to prevent future occurrences.