Center for bone and Joint Surgery of the Palm Beaches, a Florida orthopedic practice, confirmed a hacking incident affecting its network server. The breach impacted 5,461 individuals, likely patients, according to a filing with HHS Office for Civil Rights in September 2026. Specific data types exposed were not disclosed. Affected individuals should monitor credit reports and watch for phishing attempts.
| Company | Center for bone and Joint Surgery of the Palm Beaches |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Not Publicly Disclosed |
| People Affected | 5,461 individuals |
| Attack Method | Hacking/IT Incident |
| Regulators Notified | Delaware Attorney General, Vermont Attorney General, HHS Office for Civil Rights |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Center for bone and Joint Surgery of the Palm Beaches Data Breach?
Center for bone and Joint Surgery of the Palm Beaches recently confirmed a data security incident that affected its network server. The orthopedic provider, based in Florida, filed formal notice of the breach with the U.S. Department of Health and Human Services Office for Civil Rights. This filing confirms the Center for bone and Joint Surgery of the Palm Beaches data breach involved a hacking or IT-related incident.
According to the regulatory filing, the breach was reported to federal authorities in September 2026. The specific date when the intrusion first occurred has not been publicly disclosed. However, the organization has classified the event as a hacking or IT incident that affected its network server and other related systems.
Because this disclosure comes through an official HHS Office for Civil Rights filing, it reflects a confirmed finding rather than an unverified claim. As a result, affected patients can treat this notification as an authoritative source about the breach. Further details about how the attacker gained access have not been made public at this time. In addition, the organization has not released a detailed forensic timeline describing containment steps.
Who was affected?
The breach affected 5,461 individuals, according to the notification filed with federal regulators. These individuals are most likely current or former patients of the practice. Because the organization provides orthopedic and bone and joint surgical care, those affected may include people who received treatment, consultations, or surgical procedures.
The notification does not specify whether employees were also affected, so the impact may be limited to patients. Geographic scope appears centered in Florida, where the practice operates. However, patients from other states who received care at this provider could also be included in the affected group. It is not yet known whether any minors were among those impacted.
What Information Was Potentially Exposed?
The HHS filing confirms the breach involved network server systems, but it does not specify which categories of personal or medical information were accessed. Because of this, the exact types of information involved have not been publicly disclosed.
Even without confirmed details on specific data categories, breaches involving healthcare providers often carry serious risk. This is because medical practices typically store a range of sensitive records, including appointment histories and billing details. When hackers access network servers, there is a reasonable concern that personal information tied to patient records could be exposed.
If any personal or health-related information was in fact accessed, affected individuals could face risks such as identity theft or medical identity fraud. For example, stolen information could be used to open fraudulent accounts or file false insurance claims. As a result, vigilance is important even when specific data types remain unconfirmed.
In addition, healthcare-related breaches can sometimes lead to targeted phishing attempts. Scammers may pose as the provider or an insurance company to extract further details from unsuspecting patients. Because of this, individuals should treat unexpected calls or emails referencing this incident with caution.
What is the company doing?
Center for bone and Joint Surgery of the Palm Beaches filed its breach notification with the HHS Office for Civil Rights on September 25, 2026. This step is required under federal law whenever a healthcare provider experiences a breach affecting 500 or more individuals. The filing demonstrates that the organization has acknowledged the incident to regulators.
In addition to this federal filing, the practice has also submitted notifications to state regulators. Records show filings with the Vermont Attorney General and the Delaware Attorney General. These multi-state filings suggest the organization is working to meet its legal notification obligations across several jurisdictions.
Beyond these regulatory filings, the source material does not describe additional remediation steps, such as credit monitoring offers or system upgrades. Therefore, it is not yet known whether the practice is providing identity protection services to those affected. Patients should watch for a formal notification letter, which typically outlines any protective services available to them.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Affected individuals should request copies of their credit reports and review them for unfamiliar accounts or inquiries. You can obtain free reports from each of the three major credit bureaus through AnnualCreditReport.com. Doing this regularly helps catch suspicious activity early.
Because healthcare breaches can sometimes lead to fraudulent account openings, consistent monitoring matters. If you notice any unauthorized activity, report it immediately to the credit bureau and consider filing a police report. This documentation can be useful if you later need to dispute fraudulent charges.
Stay Alert for Phishing Attempts
Patients should be cautious of unexpected emails, texts, or phone calls referencing this breach or the medical practice. Scammers often use real breach events to create convincing phishing messages. For example, a fake message might ask you to verify account details or click a suspicious link.
Never provide personal information in response to an unsolicited request. Instead, contact the practice directly using a verified phone number to confirm the legitimacy of any communication. This simple step can prevent further exposure of your personal data.
Consider a Fraud Alert or Credit Freeze
Although the specific data types exposed have not been confirmed, placing a fraud alert on your credit file is a precautionary step worth considering. A fraud alert requires creditors to verify your identity before opening new accounts in your name. This can slow down identity thieves attempting to exploit stolen information.
For stronger protection, you may also consider a credit freeze, which restricts access to your credit file entirely. While this requires a bit more effort to lift temporarily when applying for credit, it offers one of the most effective defenses against new-account fraud. Both options are typically free to set up with each credit bureau.
Review Medical Records and Insurance Statements
Because this breach involves a healthcare provider, it is wise to review any insurance explanation-of-benefits statements for unfamiliar charges. Medical identity theft can result in false claims being filed under your name. Catching this early can prevent complications with your actual medical records.
If you notice any discrepancies, contact your insurance provider and the practice immediately. In addition, you may want to request a copy of your medical records to verify their accuracy. This helps ensure that fraudulent treatments or diagnoses have not been added to your file.
Consult a Data Breach Attorney
Given the number of individuals affected, some patients may want to understand their legal options. A consultation with a data breach attorney can help clarify whether you qualify for compensation related to this incident. Many attorneys offer free case evaluations for breach victims.
Because healthcare data breaches can sometimes lead to class action litigation, staying informed about your rights is important. An attorney can also help you understand any applicable deadlines for filing a claim. This step is especially useful if you experience direct financial or medical harm linked to the breach.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General
View the public data breach notification listing from Vermont Attorney General
View the public data breach notification listing from HHS Office for Civil Rights