Sutherland Healthcare Solutions; Hoag Memorial Hospital Presbyterian Announce Cyber Incidents
Data breaches have recently been confirmed by HIPAA business associate Sutherland Healthcare Solutions and the California hospital system, Hoag Memorial Hospital Presbyterian.
Sutherland Healthcare Solutions
Sutherland Healthcare Solutions, a provider of revenue cycle management, provider management and credentialing, medical coding, and digital transformation services to healthcare payers, providers, and MedTech companies, has identified a data privacy incident that occurred over a two-year period between 2024 and 2026.
According to its notification letters, unbeknownst to the company, an employee engaged another individual to conduct work duties on their behalf. At various times between July 29, 2024, and July 10, 2026, the unauthorized individual accessed information such as names, addresses, dates of birth, health plan information, Social Security numbers, health insurance claims data, and plan members’ stated gender. When the unauthorized access was identified, the employee’s access rights were swiftly terminated. The affected health plans were notified to determine the individuals and data involved, and notification letters have recently been mailed to the affected individuals.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
The unauthorized access does not appear to have been malicious in nature. Sutherland Healthcare Solutions has not identified any data misuse as a result of the incident; however, as a precaution, the affected individuals have been offered complimentary identity theft protection services and additional technical and administrative measures have been implemented to reduce the risk of similar incidents in the future. The incident is not yet shown on the HHS Office for Civil Rights breach portal, and the number of affected individuals has yet to be publicly disclosed.
Hoag Memorial Hospital Presbyterian
Hoag Memorial Hospital Presbyterian, a nonprofit hospital network serving patients in Orange County, California, has identified unauthorized access to its computer network and the potential theft of patient information. Suspicious network activity was first identified by Hoag on October 8, 2026. External cybersecurity and digital forensics experts were engaged to investigate the activity and confirmed unauthorized access.
The exposed files were reviewed, and on October 25, 2026, Hoag confirmed that personal and protected health information had been exposed. The types of information involved are not detailed in the publicly available breach notification letters; however, they are listed in the individual notification letters mailed to the affected individuals in early November. Complimentary credit monitoring and identity theft protection services have been made available, and security measures have been enhanced to prevent similar incidents in the future. The number of affected individuals has yet to be publicly disclosed.
