Two New York behavioural health providers are writing to patients about an intruder who spent four months inside the record system their counsellors use.
Accumedic Computer Systems, an EHR vendor serving behavioural health organisations, spotted suspicious activity on its network on June 8, 2026. Its outside forensics team eventually concluded an unauthorized party had been inside since April 8, and had potentially taken customer data between June 4 and June 8. Patient health information was confirmed exposed on September 1.
Two providers and a four month gap
The first patient notices went out October 30 from Hispanic Counseling Center, which runs a mental health clinic and a substance use disorder clinic on Long Island and offers bilingual counselling. Credit monitoring was offered. Neither the vendor nor the provider has published a patient count.
Brooklyn Counseling Services, which files as BCS Group, also reported a breach to state attorneys general. The letters went to one Massachusetts resident and two Vermont residents, though most affected people are likely in Brooklyn; New York’s attorney general does not publish victim counts. Those letters list names, email addresses, phone numbers, birth dates, Social Security numbers and health records, but name no vendor and no incident date. The timing points to the same platform.
Accumedic says it has added technical safeguards. The longer trail matters more than the disclosure: a behavioural health EHR held an intruder for two months before detection, another nine weeks passed before patient data was confirmed exposed, and nearly two more months elapsed before anyone was told.
HIPAA’s notification clock starts at discovery, not at confirmation. That gap is where regulators and plaintiffs’ lawyers tend to look, and it is the part of this incident most worth auditing at other practices running vendor-hosted record systems.
