Delayed patient notifications following healthcare data breaches at providers and vendors

Multiple healthcare organizations and vendors reported delayed patient notifications after discovering unauthorized access to protected health information (PHI), in some cases more than a year after the underlying compromise. In Colorado, Alpine Ear, Nose, and Throat (Alpine ENT) notified 65,648 individuals that an attacker accessed and exfiltrated files containing PHI in an incident identified on Nov. 19, 2024; the BianLian ransomware group later claimed responsibility and posted the organization to its leak site. Exposed data was described as highly sensitive, including medical information and, for some individuals, financial account data and payment card details (including CVC/expiration) and Social Security numbers; Alpine ENT reported no confirmed identity theft at the time of notification and offered credit monitoring.

Separately, Bayada Home Health Care disclosed exposure risk tied to a third-party vendor (Doctor Alliance) after Doctor Alliance reported unauthorized network access during Oct.–Nov. 2025, potentially affecting Home Health Certification and Plan of Care forms containing patient identifiers and clinical/insurance details (and SSNs for a subset). Bayada said it discontinued using Doctor Alliance and reported the matter to regulators. In another vendor-related incident, TriZetto Provider Solutions (Cognizant)—an insurance verification provider—suffered a cyberattack impacting PHI across multiple states; Oregon providers began notifying additional patients after the breach was reported as occurring in Nov. 2024 but not discovered until Oct. 2, 2025, with no financial data reportedly compromised and no evidence of misuse so far; the incident has prompted class-action lawsuits, engagement of Mandiant, and law enforcement notification.