Data Theft Incidents Are Among the Latest Hacks Against Specialty Medical Providers
Two specialty healthcare providers – a Florida-based firm that provides hospice services in several states and a Pennsylvania-based eye care practice – are notifying nearly 520,000 people that their sensitive health information was compromised in separate hacking incidents.
See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective
The organizations – VITAS Hospice Services and Tri Century Eye Care – reported their breaches to the U.S. Department of Health and Services on Nov. 14 and Oct. 31, respectively.
Miramar, Fla.-based VITAS Hospice told HHS Office for Civil Rights that its breach affected 319,177 people, and Southampton, Pa.-based Tri Century Eye Care reported that its hack affected 200,000 people.
VITAS Hospice Hack
VITAS Hospice in its breach notice said it discovered on Oct. 24 that an “unauthorized party” had compromised the account of one of the healthcare provider’s vendors and used that account to gain access to some of VITAS Hospice’s systems.
VITAS’ investigation determined that the hacker accessed certain VITAS systems between approximately Sept. 21 and Oct. 27, 2025. “In the course of that activity, the unauthorized party was able to access and download personal information about some of our patients and former patients,” VITAS said.
Information potentially compromised in the incident varies by individual but might include name, address, date of birth, phone number, Social Security numbers, driver’s license numbers, next of kin and their contact information – including name, phone number and email.
Medical information is also potentially affected, including diagnosis, medications, lab results, health conditions and treatments – as well as insurance information, including insurance ID and group ID numbers, and possibly other personal information.
“We are working with a leading cybersecurity firm to assist with our investigation and analysis, and we are reviewing and strengthening our vendor oversight and data protection protocols,” VITAS said in its breach notice, adding that it also notified law enforcement of the incident. “Our notification has not been delayed due to a law enforcement investigation,” VITAS said.
The hospice care firm said it’s unaware of any misuse of personal information affected by this incident. The firm is offering affected individuals complimentary credit monitoring and identity protection services for 24 months.
“If your family member was affected and is now deceased, you can place a deceased alert at one of the three major credit bureaus to help prevent misuse of your family member’s personal information,” VITAS said in its breach notice. “A deceased alert tells creditors to follow certain procedures, including contacting you.”
VITAS on its website describes itself as having nearly 50 years of experience in hospice care and being “the nation’s largest single-source provider of end-of-life care.” The firm said it provides services in 30 inpatient hospice units as well as patients’ homes, hospitals, nursing homes and assisted living communities for older adults in 15 states.
VITAS did not immediately respond to Information Security Media Group’s requests for additional details about the hacking incident, including the type of vendor account that was compromised.
Tri Century Eye Care Breach
In its breach notice, Tri Century Eye Care said that on Sept. 3, it identified suspicious activity within its network, promptly took steps to secure the environment and launched an investigation.
On Sept. 19, Tri Century learned of information suggesting that “an unknown actor” gained unauthorized access to its network and acquired files, some of which contained personal and protected health information of its patients and employees.
“There was no evidence of any access to our current electronic medical records system,” Tri Century said.
The investigation into the incident determined that potentially affected information, which varies by individual, included name, Social Security number, date of birth, medical or health information, health care treatment or diagnostic information, health insurance information, billing or payment information, and tax or financial information.
“We have implemented additional measures to enhance network security and minimize the risk of a similar incident occurring in the future, including enforcing stronger password requirements, more frequent required password changes, reduced access permissions and offline storage of older data,” Tri Century said.
Tri Century notified regulators and the FBI about the incident. The eye care practice said it “will cooperate with any resulting investigation, providing whatever cooperation may be necessary to hold the perpetrators accountable.”
Tri Century did not immediately respond to ISMG’s request for additional details about the hacking incident.
The HHS OCR HIPAA Breach Reporting Tool includes hundreds of major health data breaches – many of which are hacking incidents – involving specialty medical care providers. In fact, dozens of other hospice operators and vision care practices have reported large breaches in recent years.
At least 50 hospice operators have reported major health data breaches to federal regulators since 2010. As of Tuesday, the VITAS Hospice breach ranked as the largest of such hospice breaches on the HHS OCR website.
Meanwhile, Tri Century is among more than 100 eye care providers and related organizations that have reported major health data breaches to HHS OCR since 2010. To date, the largest such breach was a hacking incident reported in May 2021 by Florida-based 20/20 Eye Care Network as affecting more than 4.1 million people.
In that incident, the vision and hearing benefits administrator reported that personal and health information contained in an Amazon Web Services cloud storage bucket had been accessed or downloaded – and then deleted – by an “unknown” actor in January 2021 (see: Health Data for Millions Deleted from Cloud Bucket).