AL · HHS OCR reports
HIPAA breaches in Alabama
HIPAA breaches affecting 500 or more individuals reported to HHS OCR by covered entities listed in Alabama.
Reports
101
Individuals affected
14,149,604
Under investigation
12
Top type: Hacking/IT Incident
State breach notification law
Ala. Code §§ 8-38-1 to 8-38-12 (Data Breach Notification Act of 2018) (amended 2018)
Timing: 45 days Alabama requires covered entities (including businesses) to notify affected individuals within 45
Read the Alabama data breach notification law summaryAll reports, newest first
Page 1 of 3. 101 reports.
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Vascular Associates of South Alabama | Healthcare Provider | 623 | Sep 25, 2026 | Unauthorized Access/Disclosure | Under investigation |
| Aesto, LLC | Business Associate | 9,540,683 | Jul 31, 2026 | Hacking/IT Incident | Under investigation |
| Decatur Diagnostic Laboratory Inc. | Healthcare Provider | 500 | Jun 16, 2026 | Hacking/IT Incident | Under investigation |
| Heart South Cardiovascular Group | Healthcare Provider | 46,666 | Apr 6, 2026 | Hacking/IT Incident | Under investigation |
| The South Alabama Regional Planning Commission | Business Associate | 3,043 | Mar 18, 2026 | Hacking/IT Incident | Under investigation |
| Jackson Hospital and Clinic | Healthcare Provider | 13,910 | Feb 27, 2026 | Hacking/IT Incident | Archive (closed) |
| Jefferson-Blount-St. Clair Mental Health Authority | Healthcare Provider | 30,434 | Jan 23, 2026 | Hacking/IT Incident | Under investigation |
| Southern Immediate Care, LLC | Healthcare Provider | 7,447 | Jan 15, 2026 | Hacking/IT Incident | Under investigation |
| Methodist Homes of Alabama and Northwest Florida | Healthcare Provider | 1,406 | Jan 6, 2026 | Hacking/IT Incident | Under investigation |
| VIVA Health | Health Plan | 4,945 | Sep 26, 2025 | Unauthorized Access/Disclosure | Archive (closed) |
| Trinity Emergency Physicians, LLC | Healthcare Provider | 1,491 | Sep 16, 2025 | Hacking/IT Incident | Archive (closed) |
| Mobile Emergency Physicians, LLC | Healthcare Provider | 672 | Sep 16, 2025 | Hacking/IT Incident | Archive (closed) |
| Tombigbee Healthcare Authority dba Whitfield Regional Hospital | Healthcare Provider | 58,081 | Aug 12, 2025 | Hacking/IT Incident | Under investigation |
| Cahaba Center for Mental Health | Healthcare Provider | 15,085 | May 27, 2025 | Hacking/IT Incident | Archive (closed) |
| Shelby Dermatology d.b.a Dermatologists of Birmingham | Healthcare Provider | 86,414 | May 2, 2025 | Hacking/IT Incident | Archive (closed) |
| Alabama Ophthalmology Associates | Healthcare Provider | 131,576 | Apr 8, 2025 | Hacking/IT Incident | Under investigation |
| Methodist Homes of Alabama and Northwest Florida | Healthcare Provider | 8,711 | Jan 30, 2025 | Hacking/IT Incident | Archive (closed) |
| TruBridge, Inc. | Business Associate | 3,855 | Jan 4, 2025 | Hacking/IT Incident | Archive (closed) |
| AllyScripts, LLC | Healthcare Provider | 776 | Dec 20, 2024 | Hacking/IT Incident | Archive (closed) |
| Cardiology Associates of Mobile | Healthcare Provider | 172,678 | Dec 19, 2024 | Hacking/IT Incident | Archive (closed) |
| River Region Cardiology | Healthcare Provider | 48,600 | Dec 11, 2024 | Hacking/IT Incident | Under investigation |
| Alabama Cardiovascular Group | Healthcare Provider | 280,534 | Aug 2, 2024 | Hacking/IT Incident | Archive (closed) |
| University of Alabama at Birmingham School of Nursing | Healthcare Provider | 1,655 | Jul 26, 2024 | Unauthorized Access/Disclosure | Archive (closed) |
| Heart South Cardiovascular Group | Healthcare Provider | 20,577 | Jun 13, 2024 | Hacking/IT Incident | Archive (closed) |
| Grayson & Associates | Healthcare Provider | 573 | May 3, 2024 | Hacking/IT Incident | Archive (closed) |
| Jackson Medical Center, LLC | Healthcare Provider | 16,892 | Apr 5, 2024 | Hacking/IT Incident | Archive (closed) |
| RxBenefits, Inc. | Business Associate | 3,396 | Mar 18, 2024 | Unauthorized Access/Disclosure | Archive (closed) |
| Highland Health Systems | Healthcare Provider | 83,543 | Feb 29, 2024 | Hacking/IT Incident | Archive (closed) |
| Washington County Hospital and Nursing Home | Healthcare Provider | 29,346 | Feb 22, 2024 | Hacking/IT Incident | Archive (closed) |
| Mental Health Center of North Central Alabama, Inc. | Healthcare Provider | 75,667 | Feb 16, 2024 | Hacking/IT Incident | Archive (closed) |
| Bradford Health Services, LLC | Healthcare Provider | 28,543 | Feb 6, 2024 | Hacking/IT Incident | Under investigation |
| Burr & Forman LLP | Business Associate | 19,893 | Jan 9, 2024 | Hacking/IT Incident | Archive (closed) |
| Daleville Dental II LLC | Healthcare Provider | 5,280 | Jan 5, 2024 | Hacking/IT Incident | Archive (closed) |
| Community Tri-County Healthcare | Healthcare Provider | 5,809 | Jan 2, 2024 | Hacking/IT Incident | Archive (closed) |
| Medical Center Barbour | Healthcare Provider | 61,014 | Dec 27, 2023 | Hacking/IT Incident | Archive (closed) |
| Acadia Health, LLC d/b/a Just Kids Dental | Healthcare Provider | 129,463 | Sep 27, 2023 | Hacking/IT Incident | Archive (closed) |
| AIDS Alabama, Inc. | Healthcare Provider | 1,922 | Sep 26, 2023 | Hacking/IT Incident | Archive (closed) |
| HC3, Inc | Business Associate | 1,105 | Jun 11, 2023 | Unauthorized Access/Disclosure | Archive (closed) |
| Upstream RollCo, LLC | Healthcare Provider | 748,678 | Apr 22, 2023 | Hacking/IT Incident | Archive (closed) |
| Pathway Healthcare, LLC | Healthcare Provider | 1,304 | Apr 11, 2023 | Unauthorized Access/Disclosure | Archive (closed) |
| NorthStar Emergency Medical Services | Healthcare Provider | 82,450 | Mar 14, 2023 | Hacking/IT Incident | Archive (closed) |
| Cardiovascular Associates | Healthcare Provider | 433,348 | Feb 3, 2023 | Hacking/IT Incident | Archive (closed) |
| DCH Health System | Healthcare Provider | 2,530 | Jan 20, 2023 | Unauthorized Access/Disclosure | Archive (closed) |
| Legacy Operating Company d/b/a Legacy Hospice | Healthcare Provider | 21,202 | Dec 22, 2022 | Hacking/IT Incident | Archive (closed) |
| Henderson & Walton Women’s Center, P.C. | Healthcare Provider | 34,306 | Aug 23, 2022 | Hacking/IT Incident | Archive (closed) |
| Blue Cross and Blue Shield of Alabama | Health Plan | 8,702 | Jul 19, 2022 | Hacking/IT Incident | Archive (closed) |
| Alabama Eye & Cataract, P.C. | Healthcare Provider | 25,900 | Jun 20, 2022 | Hacking/IT Incident | Archive (closed) |
| Grandview Medical Center | Healthcare Provider | 1,126 | Jun 6, 2022 | Theft | Archive (closed) |
| McCoy Vision Center | Healthcare Provider | 33,930 | Jun 3, 2022 | Hacking/IT Incident | Archive (closed) |
| Aesto, LLC d/b/a Aesto Health | Business Associate | 17,400 | May 20, 2022 | Hacking/IT Incident | Archive (closed) |
Source: HHS OCR Breach Portal, OCR export October 2026.