Patient Data Exposed in Cybersecurity Incident at Ohio Revenue Cycle Management Company
Security incidents have resulted in the exposure of patient data at United Technology Systems, Meridian Health Plan of Illinois, and Little Flower Children and Family Services.
Unlimited Technology Systems
Unlimited Technology Systems LLC (UTS), a Montgomery, Ohio-based revenue cycle management company and practice management software provider, has identified unauthorized activity within a commercial data center that contained the personal and protected health information of patients of its healthcare provider clients.
According to its data breach notification letter, unauthorized activity was identified on October 19, 2025. Assisted by a third-party cybersecurity and digital forensics company, UTS determined that an unauthorized third party may have obtained a copy of files from that environment between October 5 and October 10, 2025.
The data review has recently been completed, and UTS has confirmed that the following types of information may have been involved: name, address, email address, phone number, date of birth, health insurance information, patient balance information, Social Security number, medical information including diagnosis, and scanned documents such as driver’s license or other government ID documents. UTS said full medical records, medical images, and financial information were not involved.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
As a precaution against data misuse, the affected individuals have been offered complementary credit monitoring services for 24 months, and UTS has implemented enhanced security measures to prevent similar incidents in the future. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.
Meridian Health Plan of Illinois
Meridian Health Plan of Illinois, a government-sponsored managed care service provider, has announced a data breach affecting 21,027 individuals. The incident was detected on April 28, 2026, when unauthorized access to the Meridian provider portal was identified. The provider portal is used by healthcare providers to manage patient information and process claims.
The unauthorized access was blocked, and an investigation was launched to determine the nature and scope of the breach. Meridian Health Plan has confirmed that personally identifiable information such as member names, contact information, and dates of birth had been exposed, along with protected health information such as Member ID numbers, health plan names, eligibility and claims information, and provider information. At the time of issuing notification letters, no misuse of the exposed information had been identified. Credit monitoring and identity theft protection services do not appear to have been made available.
Little Flower Children and Family Services
Little Flower Children and Family Services, a New York-based provider of support services to individuals with developmental disabilities and their families, has recently issued notification letters to individuals informing them that some of their information was exposed in a recent security incident.
Unusual network activity was identified on March 20, 2026, and the forensic investigation confirmed unauthorized access to its network between March 12, 2026, and March 20, 2026. While the review of the affected data is ongoing to determine the specific information exposed, Little Flower Children and Family Services said the types of data likely compromised in the incident include the following:
Name, address, phone number, email address, date of birth, Social Security number, driver’s license number, state ID number, taxpayer ID number, passport number, financial account information, payment card information, digital signature, biometric data, diagnosis and treatment information, prescription information, Medicare/Medicaid number, health insurance information, and treatment cost information. The affected individuals are being offered complementary credit monitoring and identity theft protection services, and steps have been taken to improve security to prevent similar incidents in the future.
