Oregon Dental Practice Reports Two Data Breaches Affecting More Than 31,000 Patients - The HIPAA Journal
Three healthcare providers have announced data breaches affecting over 31,000 patients, with Hood River Dental in Oregon reporting two separate incidents.
Hood River Dental, an Oregon dental practice with two locations, has recently reported two data security incidents to the HHS' Office for Civil Rights. The first incident, identified around October 22, 2025, affected 16,609 individuals, while a second breach discovered on January 15, 2026, compromised the data of 14,677 patients. Both breaches were confirmed on September 8, 2026, to have exposed patient information.
The unauthorized access in both incidents potentially exposed sensitive information including names, dates of birth, financial account details, payment card information, driver's license numbers, Social Security numbers, medical record numbers, diagnoses, treatment information, and health insurance data.
Liberty Healthcare Breach
Liberty Healthcare Group, which operates senior living communities and healthcare facilities across six states, is investigating a cybersecurity incident first detected on August 7, 2026. The company has isolated affected systems and engaged third-party cybersecurity experts to determine the cause of suspicious activity.
While unauthorized access has been confirmed, Liberty Healthcare has not yet determined the number of affected individuals, though the HHS breach portal lists at least 501 individuals. Compromised information likely includes full names, addresses, birth dates, medical information, and health insurance details.
Ohio Dental Practice Incident
Keep Smiling Dental Group in Ohio identified a network disruption on September 7, 2026, which led to the discovery that an unauthorized third party had accessed its computer network between August 29 and September 5, 2026. The practice confirmed that files containing patient information were accessed during this period.
Several steps have been taken to improve security to prevent similar incidents in the future, including implementing additional cybersecurity measures, server-side security enhancements, and additional anti-phishing training for the workforce.
The compromised data varies by individual but may include names, addresses, phone numbers, email addresses, dates of birth, medical histories, dental records, insurance information, and for some patients, Social Security numbers.
Related
