Cyberattacks on Healthcare Providers Highlight HIPAA Compliance Risks and Data Exposure In December 2025, three healthcare providers New Age Dermatology, Carolina Foot & Ankle Associates, and Marin Cancer Care reported cybersecurity incidents involving unauthorized access to patient data. ### New Age Dermatology (Massachusetts) A ransomware attack detected on or around December 20, 2025, targeted an internal server, rendering it inoperable. While the investigation is ongoing, New Age Dermatology confirmed that personal and protected health information (PHI) including names, dates of birth, medical/treatment details, diagnostic images, photographs, and Social Security numbers was likely compromised. The electronic medical record system remained unbreached. Law enforcement was notified, and affected individuals were offered complimentary credit monitoring and identity theft protection services for 12 months. ### Carolina Foot & Ankle Associates (North Carolina) A cybersecurity incident detected on December 8, 2025, involved unauthorized network access and file exfiltration. Compromised data included names, phone numbers, dates of birth, medical record numbers, health insurance information, diagnostic/CPT codes, and dates of service. Social Security numbers and financial information were unaffected, and the electronic medical record system remained secure. ### Marin Cancer Care (California) An intrusion detected on December 8, 2025, revealed unauthorized access to its network between November 22 and December 6, 2025. Files containing patient names, medical information, and health insurance details were likely viewed or acquired. Immediate security enhancements were implemented, and affected individuals were offered credit monitoring and identity theft protection services. The breach was reported to the HHS’ Office for Civil Rights with an initial estimate of at least 501 affected individuals. ### HIPAA Compliance and Security Gaps The incidents underscore persistent vulnerabilities in healthcare cybersecurity, including: - Phishing and email-based attacks as primary entry points. - Insufficient workforce training on identifying malicious software and reporting threats. - Delayed breach notifications, increasing risks of identity theft and fraud. - Inadequate access controls, including shared login credentials and improperly configured audit logs. - Gaps in business associate oversight, where third-party vendors may introduce compliance risks. HIPAA regulations require ongoing security awareness training, documented risk analyses, and timely breach reporting to mitigate such incidents. The attacks also highlight the need for automated logoff capabilities, data backup plans, and disaster recovery protocols to protect PHI integrity.

Marin Cancer Care Data Breach Exposes Patient Information in 2015 Incident Marin Cancer Care, a California-based cancer treatment center, disclosed a data breach that occurred in November 2015, with unauthorized access detected on December 8 of that year. The breach exposed sensitive patient data, including names, health insurance details, and medical records. Located in Greenbrae, CA, Marin Cancer Care has provided oncology and supportive care services since 1952. Following the discovery, the organization engaged third-party cybersecurity investigators to assess the scope of the incident. While the exact number of affected individuals remains unknown, the breach was reported to the U.S. Department of Health and Human Services on February 6, 2026. The investigation into the incident is ongoing. Legal firms are currently reviewing potential compensation claims for impacted patients. Marin Cancer Care has published details of the breach on its website.