Two recent breach notices from healthcare practices tell the same story: the trouble started in an ordinary office email account. HIPAA Journal reported on both on Oct. 23, 2026, and the practices' own notices spell out what happened.
Park Dental (Young C. Park DDS, PC) in Roanoke, Virginia, says it found "unauthorized remote access to a workstation and associated office email account." Heritage Pediatrics in San Antonio, Texas, says it became aware of "fraudulent emails being sent from a single employee's account." Neither practice described ransomware, and neither reported an outage.
What the practices have said
Park Dental (Roanoke, Va.):
- When: The access "occurred intermittently between June 10, 2026, and July 22, 2026, and was discovered on July 22, 2026."
- What was involved: Information in office email accounts "and possibly Park Dental's patient record and practice-management systems." That may include names, contact details, dates of birth, chart numbers, appointment details, referral communications, dental X-rays and imaging, diagnoses, treatment plans and notes, and insurance and billing information.
- How many: HIPAA Journal reports the breach was reported to HHS as affecting approximately 12,000 people.
- What it doesn't mean: The practice says its notice "does not mean that any individual's information was actually accessed, viewed, copied, or misused."
- What it changed: Per HIPAA Journal, Park Dental strengthened account and remote access security, increased monitoring, changed passwords, updated access privileges and planned more staff training.
Heritage Pediatrics (San Antonio, Texas):
- When: "On or about April 12 or 13, 2026," the practice saw fraudulent emails going out from one employee's account. It secured its environment and investigated with outside cybersecurity professionals.
- What was involved: Depending on the person, names with Social Security numbers, dates of birth, ID or passport numbers, financial account and card information, health insurance details, and clinical, diagnosis and treatment information.
- How many: The breach was reported to the Texas Attorney General as affecting 2,876 Texas residents, according to ClaimDepot's review of the filing. Notices went out on Oct. 19, 2026.
- Misuse: The practice says it has "no reason to believe" the incident will lead to improper use of the information.
Not known: Neither notice says how the attacker got into the account, whether a phishing email or a reused password was involved, or whether MFA was turned on. In the notices and coverage we reviewed, neither incident has been tied to a ransomware group, and neither practice reported any confirmed misuse of patient data.
Why it matters to dental and medical practices
In a small practice, the inbox is where everything lands: referral letters, insurance correspondence, X-rays a specialist asked for, scanned intake forms. One account can hold years of patient information that nobody meant to store there. When someone gets into it, the practice has to review every message to work out who's affected, which is why notices like these often go out months after the break-in.
A hijacked account also gets used. Heritage Pediatrics found out because fraudulent emails were going out under an employee's name. Patients, labs and referring offices trust mail from your address, so a compromised account is a ready-made phishing machine.
Clear takeaway
Treat every staff email account as a patient-records system. Put app-based MFA on all of them, turn off old sign-in methods, get an alert when someone creates a forwarding rule or signs in from somewhere unusual, and stop keeping X-rays and charts in the inbox longer than you need to.
Actions to take this week
- MFA on every mailbox. That includes shared front-desk, billing and "info@" accounts, and the doctor's account that "never gets used." Prefer an authenticator app or security key over text codes.
- Turn off legacy sign-ins. Ask your IT provider to block older email protocols that skip MFA, and to require MFA for remote access to any workstation.
- Check for forwarding rules. Attackers often add a rule that quietly forwards or deletes mail. Have someone review inbox rules and external forwarding on every account now, then set alerts for new ones.
- Review who can reach your workstations remotely. Park Dental's incident began with remote access to a workstation. List every remote access tool installed, remove the ones you don't use, and make sure the rest need MFA.
- Clean out the inbox. Move X-rays, charts and referral attachments into your practice-management or imaging system, then delete them from email on a set schedule. Less stored mail means a smaller breach and a faster review.
- Tell staff what to report. A patient asking "did you send me this?" or a bounce for a message nobody sent is an early warning. Make it easy to report right away, and have a one-page plan for locking the account and calling your IT provider.
- Know your notice duties. Keep your HIPAA risk assessment current and know who you'd call for breach notification advice if an account is ever compromised.
Brotherly Technology helps dental offices, medical practices and specialty clinics across Rome, Northwest Georgia, Atlanta, Chattanooga and the Southeast lock down Microsoft 365 and Google Workspace email, set up sign-in alerts and keep patient files out of inboxes. If you'd like a quick email security check for your practice, give us a call.
Sources:
- WSLS 10: "Roanoke Dental practice, Park Dental, issues data security incident notice" (Sept. 21, 2026). Publishes the practice's statement; source for Park Dental quotes, dates and data types.
- Heritage Pediatrics: Notice of Data Security Incident (Oct. 19, 2026). Source for Heritage Pediatrics quotes, dates and data types.
- HIPAA Journal: "Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals" (Oct. 23, 2026). Source for the Park Dental HHS count and remediation steps.
- ClaimDepot: "Heritage Pediatrics Data Breach Exposed Protected Health Information and More" (Oct. 20, 2026). Source for the Texas Attorney General filing count.