Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals
Originally at news.google.com
Summary & scoring by The Bell Brief (Dr. Jennifer Bell) using the Drill-Down Protocol (Drill-Down Score) — not the original publisher.
Why it matters for dental
Dental practices and DSOs that outsource billing, legal, or IT work to vendors must treat those vendors as business associates under HIPAA; a breach at any one of them can trigger mandatory patient notifications and expose the practice to OCR enforcement.
Key points
- Tarter Krinsky & Drogin, a Manhattan law firm that serves healthcare clients, confirmed unauthorized access to servers between July 9, 2025 and September 9, 2025, exposing protected health information of 196,645 individuals.
- Young C. Park DDS, PC, operator of Park Dental in Roanoke, Virginia, reported an email-account breach that exposed names, x-rays, diagnoses, treatment plans, and billing records of approximately 12,000 patients.
- Heritage Pediatrics PLLC in San Antonio, Texas, notified affected individuals on or around October 19, 2026 after confirming a single employee email account had been compromised, potentially exposing clinical and insurance information.
- All three entities stated they have implemented additional cybersecurity measures, including strengthened account controls, increased monitoring, and updated access privileges.
Who should care
Read the original on Media: Practice risk & enforcement
Full reporting and any paywall content live on news.google.com. We summarize and score; we do not republish.
Related
- ·Regulatory
Feds launch False Claims Act self-disclosure pilot program: 5 notes for dental leaders
- ·Regulatory
Lawmakers target healthcare oversight: 5 new laws for dental leaders to know
- ·Business
When patients ask ChatGPT about dental care, these are the websites it cites most
- ·Regulatory
Dentists Win at the Supreme Court, But Conduent Gets Tossed a Bone