Two recent breaches at Casper Orthopedic Associates and Atlantic Digestive Specialists reveal a troubling gap in healthcare cybersecurity: while most organizations can detect an intrusion quickly, confirming which patient records were compromised takes months. This delay in notification increases regulatory risk and highlights a fundamental weakness in how you're tracking Protected Health Information (PHI).
What the Data Shows
Casper Orthopedic Associates discovered unauthorized access on May 23, 2026, and contained the incident within three weeks. However, the data review wasn't completed until September 2, over three months later. The organization notified 56,197 individuals on September 8, 2026. The compromised data included names, dates of birth, driver's license numbers, Social Security numbers, financial account information, and medical information.
Atlantic Digestive Specialists detected suspicious network activity in March 2026 and determined that an unauthorized party accessed its network between March 16 and March 17, 2026. Yet, the data review wasn't completed until September 8, 2026, and notification letters didn't start going out until September 30. The compromised data set was broader, including names, dates of birth, Social Security numbers, and more.
Both organizations engaged third-party cybersecurity experts and contained the intrusion quickly. Yet both took months to determine what was taken.
Key Findings
Finding 1: Detection speed doesn't equal notification speed. You can spot an intruder in days, but if you can't map which files they touched to which patient records, you're stuck in a months-long forensic review. The Breach Notification Rule gives you 60 days from discovery to notify affected individuals, not 60 days from when you finish your data review. If your forensic process routinely takes over 90 days, you're starting the clock late.
Finding 2: The breadth of compromised data types is expanding. Atlantic Digestive Specialists' list spans 24 distinct data elements. When conducting your annual Security Rule risk analysis under 45 CFR § 164.308(a)(1)(ii)(A), are you inventorying every PHI field your EHR and billing systems store? If your breach notification template assumes name + SSN + diagnosis, you're underpreparing.
Finding 3: Third-party experts are now standard, not optional. Both organizations brought in external cybersecurity firms immediately. If you're waiting until after the breach to identify a qualified forensics partner, you're adding days or weeks to your response timeline. Your incident response plan should include pre-negotiated contracts with forensic investigators who understand HIPAA's regulatory clock.
What This Means for Your Team
You're operating under a structural disadvantage: attackers move faster than your data governance allows you to respond. Most covered entities can't answer "which patient records did this user access?" without manually reviewing logs, cross-referencing file paths, and reconstructing database queries. That's a documentation problem, not just a security issue.
The Office for Civil Rights (OCR) will evaluate whether your delay in notification was reasonable given the complexity of the breach. If you took four months to complete a data review because your PHI inventory was incomplete or your access logs weren't correlated to patient identifiers, that's a corrective action waiting to happen.
Action Items by Priority
Priority 1: Map your PHI inventory to access logs now. Document which systems store PHI, which user roles can access each system, and how you'll correlate system logs to patient identifiers. If your EHR vendor can't produce a report showing "all records accessed by User X between Date Y and Date Z," that's a gap your risk analysis must address under the Security Rule's audit controls standard at 45 CFR § 164.312(b).
Priority 2: Pre-negotiate forensic response contracts. Identify two qualified cybersecurity firms with healthcare breach experience. Negotiate retainer agreements or pre-approved scopes of work. Specify turnaround expectations for containment (72 hours), preliminary findings (one week), and final data review (30 days). Build these timelines into your incident response plan and test them annually.
Priority 3: Separate containment from investigation. Your first 48 hours should focus on stopping the intrusion and preserving evidence. Your next 30 days should focus on determining what was accessed. Don't let the forensic investigation delay your containment decisions. If you wait for a complete data review before you patch the vulnerability or revoke compromised credentials, you're leaving the door open.
Priority 4: Audit your notification timeline assumptions. Review your last three breach notification drills. How long did it take to move from "suspicious activity detected" to "notification letters mailed"? If your realistic timeline exceeds 60 days, you need to either accelerate your data review process or document why the delay is unavoidable, because OCR will ask.
Priority 5: Expand your breach notification template. If your current template lists eight data elements and the actual breach involves 24, you'll need to revise that letter under time pressure while patients are waiting. Build a modular template that can accommodate the full range of identifiers your systems store, including financial account information and authentication credentials.
By addressing these areas, your team can improve response times and reduce regulatory risks associated with data breaches.
