Healthcare Data Breaches and Patient Data Exposure Reports

Multiple organizations reported or were alleged to have suffered data breaches involving sensitive personal and health information. Telehealth provider Call-On-Doc was allegedly breached in early December, with a hacking-forum listing claiming exfiltration of 1,144,223 patient records including contact details and highly sensitive visit metadata (e.g., medical category/condition, including STD-related entries), though the company had not publicly commented at the time of reporting. Separately, Laurel Health Centers (a Federally Qualified Health Center network in Northern Pennsylvania) reported unauthorized access to its email environment from July 11–25, 2025; emails and attachments may have been viewed or copied, potentially exposing a wide range of PHI/PII (including SSNs, insurance/Medicare data, diagnostic/treatment information, and some financial data). Laurel stated it took time to confirm the threat actor was fully removed, completed mailbox review by Dec. 30, 2025, and then began notifying affected individuals and offering credit monitoring.

Outside healthcare delivery, the Civil Service Employees Association (CSEA) labor union reported a May intrusion (May 3–31) resulting in theft of data for 47,000+ members, including names and Social Security numbers, and said it took systems offline, reset passwords, and implemented additional security controls; it reported no evidence of misuse but advised vigilance for identity theft. A separate HIPAA Journal item summarized academic research on insider risk—finding many students would hypothetically sell patient data for money—which is not tied to a specific breach incident but underscores the broader threat environment for healthcare data.