The HHS Office for Civil Rights breach portal lists 4 large HIPAA breach submissions with a breach submission date of September 25, 2026. Combined, these filings report 7,304 individuals affected nationally (not state-resident totals).
The largest filing — Center for bone and Joint Surgery of the Palm Beaches (FL) — accounts for 5,461 individuals in this batch. See our live HIPAA / HHS OCR statistics and healthcare AG tracker for broader context.
September month-to-date now totals 33 OCR submissions covering 495,414 individuals dated through September 25, 2026 on the under-investigation portal view.
Submissions Dated September 25, 2026
| Organization | State | Entity Type | Individuals | Breach Type | Submitted |
|---|---|---|---|---|---|
| Center for bone and Joint Surgery of the Palm Beaches | FL | Healthcare Provider | 5,461 | Hacking/IT Incident | 09/25/2026 |
| Source Care Management, LLC d/b/a NextStep Care | GA | Healthcare Provider | 685 | Unauthorized Access/Disclosure | 09/25/2026 |
| Vascular Associates of South Alabama | AL | Healthcare Provider | 623 | Unauthorized Access/Disclosure | 09/25/2026 |
| Kostelic and Associates 3PLLC | NC | Healthcare Provider | 535 | Hacking/IT Incident | 09/25/2026 |
OCR lists breaches affecting 500 or more individuals. Submission dates reflect when the covered entity reported to OCR; investigation status and counts can change as the portal updates.
Independent Cybersecurity Audits
EmailMeNow domain audits on September 25, 2026 scored 3 filer domains in this batch.
3 of 3 show 15% Transport Security or below — a recurring gap that makes spoofed breach-notification email easier to deliver.
Vascular Associates of South Alabama (vascular.com) leads at 37% overall; Source Care Management, LLC d/b/a NextStep Care (source.org) scores 27%.
Pattern: Scores below the 100% ideal on identity or transport still leave room for spoofed incident-response email — even when website headers score higher.
| Organization | Domain | Overall | Identity | Transport | Website | Risk |
|---|---|---|---|---|---|---|
| Source Care Management, LLC d/b/a NextStep Care | source.org | 27% | 0% | 15% | 40% | Weakest |
| Vascular Associates of South Alabama | vascular.com | 37% | 25% | 15% | 37% | Weak |
| Kostelic and Associates 3PLLC | kostelic.com | 32% | 10% | 15% | 40% | Weak |
Audit links: source.org · vascular.com · kostelic.com
Related trackers
- HIPAA / HHS OCR statistics
- Healthcare AG breach tracker
- Texas healthcare breaches (2026)
- All state AG trackers
- Breach monitoring guide
Source: HHS OCR Breach Portal