An orthopedic group with five clinics across Las Vegas and Henderson is telling patients that an intruder may have walked off with their medical and personal records.
Desert Orthopaedic Center detected unauthorized access on or around August 7, 2026. A review of the affected files found a broad haul: names, contact details, birth dates, and Social Security numbers, alongside treatment and diagnosis information, prescriptions, dates of service, provider names, medical record numbers, patient account numbers, Medicare and Medicaid ID numbers, insurance details, and billing claims.
Notification letters began reaching patients in early October, and the practice is offering credit monitoring and identity theft protection. It has not yet appeared on the HHS Office for Civil Rights portal, so the number of people affected remains unknown.
The Center is not alone in this batch. In Pennsylvania, medical management and billing provider Secure Healthcare Information Management said a network disruption surfaced on July 17. Its probe found an intruder inside the network from July 6 to July 16, and a September 18 review confirmed patient names, birth dates, Social Security numbers, driver’s license numbers, medical information, and health insurance data may have been acquired. That vendor began notifying people on October 6.
The two cases underline a familiar pattern. A single-practice intrusion and a business associate breach can expose the same data categories, and both leave patients exposed to identity theft long after the letters arrive.
For healthcare organizations, the lesson sits on the vendor side. Business associates handling billing and records for dozens of practices concentrate risk: one compromise ripples across every client. Contract language, access limits, and continuous monitoring of those relationships matter as much as perimeter defense.
