Kentucky healthcare breach data

A breach can involve an organization located in one state while notices about the same event appear through several other states. This page keeps those apart: 19 events involve an organization located in Kentucky, and 11 appear through Kentucky notice activity. Reconciled from 33 source records under Canonical Data Model 1.1.

Events at organizations located in Kentucky

Events with Kentucky notice activity

1.1M

Reported affected, event totals

Hacking / IT incident

Most common mechanism

The two counts above answer different questions and are not added together: one says the breached organization is located in Kentucky, the other says a notice about the event appears through Kentucky. Neither states where an incident physically happened, which these sources do not establish. Reported affected is an event total, not a count of Kentucky residents: unless a source scopes its figure to one state, it covers everyone the breach affected anywhere. For the same reason state figures do not sum to the national total — one breach reported through several jurisdictions is one event appearing under each of them. How these numbers are calculated.

Recent events

Latest breach events reported in Kentucky

Jun 19, 2026·30,830 reported affected·Hacking / IT incident·1 source record
Kentucky Mountain Health Alliance
Reported to HHS OCR.
Jun 13, 2026·537 reported affected·Hacking / IT incident·1 source record
Kentucky MSO, LLC
Reported to HHS OCR.
Apr 23, 2026·3,677 reported affected·Hacking / IT incident·1 source record
Stewart Home & School
Reported to HHS OCR.
Mar 4, 2026·63,657 reported affected·Hacking / IT incident·1 source record
Dermatology Associates
Reported to HHS OCR.
Feb 28, 2026·1,000 reported affected·Hacking / IT incident·1 source record
Insurance ACE/Humana Inc.
Reported to HHS OCR.
Feb 27, 2026·9,651 reported affected·Hacking / IT incident·1 source record
CenterWell ACE/Home Solutions
Reported to HHS OCR.
Feb 27, 2026·11,474 reported affected·Hacking / IT incident·1 source record
Orthopaedic Institute of Western Kentucky
Reported to HHS OCR.
Jan 5, 2026·7,990 reported affected·Unauthorized access or disclosure·1 source record
HealthPoint Family Care
Reported to HHS OCR.
Oct 24, 2025·9,536 reported affected·Hacking / IT incident·1 source record
Physicians to Children & Adolescents
Reported to HHS OCR.
Oct 3, 2025·501 reported affected·Hacking / IT incident·1 source record
Dermatology Associates
Reported to HHS OCR.
Jun 26, 2025·4,947 reported affected·Hacking / IT incident·1 source record
Jordan Drug, Inc.
Reported to HHS OCR.
Jun 13, 2025·166,953 reported affected·Hacking / IT incident·1 source record
Central Kentucky Radiology
Reported to HHS OCR.

Most affected entities

Organizations in Kentucky by breach events

Insurance ACE/Humana Inc.

events

24.6K

reported affected

Dermatology Associates

events

64.2K

reported affected

Commonwealth Medical Group

event

250K

reported affected

Norton Healthcare

event

200K

reported affected

Central Kentucky Radiology

event

167K

reported affected

Incident mechanisms

How breaches happen in Kentucky

How the 30 canonical breach events with a Kentuckysource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident15 (50%)
Ransomware / malware5 (17%)
Unauthorized access or disclosure5 (17%)
Unknown mechanism5 (17%)

Kentucky compliance requirements

Kentucky breach notification law

Beyond federal HIPAA requirements, Kentucky has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

KRS 365.732(2)

Notification deadline

In the most expedient time possible and without unreasonable delay following discovery or notification of the breach of the security of the data, consistent with (i) the legitimate needs of law enforcement as provided in KRS 365.732(4), or (ii) any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound.

State regulator notice

Not required

None. KRS 365.732 does not impose an affirmative Attorney General notice obligation. The Kentucky Attorney General has general consumer-protection enforcement authority but no notification trigger appears in KRS 365.732 itself.

§ 365.732(8) excludes 'person who is subject to HIPAA' — includes CE and BA to the extent each is subject

KRS 365.732(8) is a section-level exclusion — 'The provisions of this section... shall not apply to any person who is subject to... HIPAA.' The Kentucky statute does not expressly name covered entities or business associates. The exclusion reaches HIPAA CEs (subject to HIPAA breach-notification obligations under 45 CFR §§ 164.400-408) AND HIPAA BAs (subject to direct breach-notification obligations under 45 CFR § 164.410 post-HITECH) — but coverage is scoped to the extent each entity is itself subject to HIPAA in the relevant respect. The classification CE_AND_BA_ENTITY_EXCLUSION reflects that reach, not an assertion that Kentucky's statute textually enumerates covered entities or business associates. For a HIPAA-regulated dental, medical, behavioral-health, chiropractic, physical-therapy, or optometry practice operating in Kentucky (or a HIPAA BA of such a practice), KRS 365.732 does NOT apply — including the § 365.732(7) 1,000-person CRA-notice obligation — to the extent the practice or BA is subject to HIPAA in the incident.

'Breach' definition in KRS 365.732(1)(a) requires actual/reasonable-belief of identity-theft or fraud harm

KRS 365.732(1)(a) defines 'breach of the security of the system' as unauthorized acquisition of unencrypted personally identifiable information that 'actually causes, or leads the information holder to reasonably believe has caused or will cause, identity theft or fraud against any resident of the Commonwealth of Kentucky.' This is a materiality/harm gate at the definition level — a Kentucky breach isn't a 'breach' under KRS 365.732 unless it actually causes or reasonably will cause ID-theft or fraud harm to a Kentucky resident. For a HIPAA-regulated entity that IS still within § 365.732 (e.g., an entity not subject to HIPAA), this materiality gate operates in addition to HIPAA's own breach-notification risk-assessment framework at 45 CFR § 164.402.

2025-2026 currentness note

KRS 365.732 substantive text confirmed against apps.legislature.ky.gov Kentucky Legislative Research Commission's primary-source PDF publication on 2026-08-23. Section created 2014 Ky. Acts ch. 84, sec. 1, effective July 15, 2014. No 2025 or 2026 Kentucky amendments to KRS 365.732 were identified in this session's primary-source review. If a future Kentucky session amends KRS 365.732 or related provisions in KRS Chapter 61, this record must be re-verified.

This is a general reference based on current Kentucky law. Consult legal counsel for state-specific compliance obligations. Source: KRS 365.732(2). Per-jurisdiction verification status and primary-source references are shown on each specialty/state compliance page.

Protect your Kentucky practice

30 breach events in Kentucky. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in Kentucky

How many healthcare data breaches have been reported in Kentucky?

19 canonical breach events involve an organization located in Kentucky, and 11 appear through Kentucky notice activity. Those are different relationships and are not added together — a breach at an organization elsewhere can be notified through Kentucky. Together the events on this page report 1.1M individuals affected, an event total counting everyone each breach affected anywhere, not a count of Kentucky residents. Sourced from HHS OCR breach reports and state attorney general notices, reconciled under Patient Protect Canonical Data Model 1.1. Updated nightly.

What is the most common breach mechanism in Kentucky?

The most frequently reported incident mechanism in Kentucky is Hacking / IT incident, present in 15 of 30 canonical breach events. Ransomware / malware follows with 5.

Are independent practices in Kentucky at higher risk?

Independent healthcare practices are the fastest-growing target for healthcare cyberattacks nationwide — attacks on small providers have increased 6x since 2021. Kentucky practices face the same threat landscape with fewer resources to defend against it. Patient Protect provides breach prevention specifically for independent practices starting at $39/month.

What are Kentucky's breach notification requirements?

Kentucky requires breach notification in the most expedient time possible and without unreasonable delay following discovery or notification of the breach of the security of the data, consistent with (i) the legitimate needs of law enforcement as provided in KRS 365.732(4), or (ii) any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound. A practice that is a HIPAA covered entity is outside this section, so federal HIPAA notice governs. Reference: KRS 365.732(2).

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Data Disclaimer: This page counts canonical breach events reconciled from the HHS OCR Breach Portal and state attorney general breach notifications under Patient Protect Canonical Data Model 1.1. Regulatory enforcement actions, security advisories, community reports and algorithmically modeled records are held separately and are not counted here. Data is provided “as-is” for informational purposes only. Inclusion of any entity does not imply wrongdoing. Users must independently verify information before relying on it. See Terms of Use.

Kentucky healthcare breach data

Events at organizations located in Kentucky

Events with Kentucky notice activity

1.1M

Reported affected, event totals

Hacking / IT incident

Most common mechanism

Recent events

Latest breach events reported in Kentucky

Jun 19, 2026·30,830 reported affected·Hacking / IT incident·1 source record
Kentucky Mountain Health Alliance
Reported to HHS OCR.
Jun 13, 2026·537 reported affected·Hacking / IT incident·1 source record
Kentucky MSO, LLC
Reported to HHS OCR.
Apr 23, 2026·3,677 reported affected·Hacking / IT incident·1 source record
Stewart Home & School
Reported to HHS OCR.
Mar 4, 2026·63,657 reported affected·Hacking / IT incident·1 source record
Dermatology Associates
Reported to HHS OCR.
Feb 28, 2026·1,000 reported affected·Hacking / IT incident·1 source record
Insurance ACE/Humana Inc.
Reported to HHS OCR.
Feb 27, 2026·9,651 reported affected·Hacking / IT incident·1 source record
CenterWell ACE/Home Solutions
Reported to HHS OCR.
Feb 27, 2026·11,474 reported affected·Hacking / IT incident·1 source record
Orthopaedic Institute of Western Kentucky
Reported to HHS OCR.
Jan 5, 2026·7,990 reported affected·Unauthorized access or disclosure·1 source record
HealthPoint Family Care
Reported to HHS OCR.
Oct 24, 2025·9,536 reported affected·Hacking / IT incident·1 source record
Physicians to Children & Adolescents
Reported to HHS OCR.
Oct 3, 2025·501 reported affected·Hacking / IT incident·1 source record
Dermatology Associates
Reported to HHS OCR.
Jun 26, 2025·4,947 reported affected·Hacking / IT incident·1 source record
Jordan Drug, Inc.
Reported to HHS OCR.
Jun 13, 2025·166,953 reported affected·Hacking / IT incident·1 source record
Central Kentucky Radiology
Reported to HHS OCR.

Most affected entities

Organizations in Kentucky by breach events

Insurance ACE/Humana Inc.

events

24.6K

reported affected

Dermatology Associates

events

64.2K

reported affected

Commonwealth Medical Group

event

250K

reported affected

Norton Healthcare

event

200K

reported affected

Central Kentucky Radiology

event

167K

reported affected

Incident mechanisms

How breaches happen in Kentucky

How the 30 canonical breach events with a Kentuckysource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident15 (50%)
Ransomware / malware5 (17%)
Unauthorized access or disclosure5 (17%)
Unknown mechanism5 (17%)

Kentucky compliance requirements

Kentucky breach notification law

Beyond federal HIPAA requirements, Kentucky has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

KRS 365.732(2)

Notification deadline

State regulator notice

Not required

§ 365.732(8) excludes 'person who is subject to HIPAA' — includes CE and BA to the extent each is subject

'Breach' definition in KRS 365.732(1)(a) requires actual/reasonable-belief of identity-theft or fraud harm

2025-2026 currentness note

Protect your Kentucky practice

30 breach events in Kentucky. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in Kentucky

How many healthcare data breaches have been reported in Kentucky?

What is the most common breach mechanism in Kentucky?

The most frequently reported incident mechanism in Kentucky is Hacking / IT incident, present in 15 of 30 canonical breach events. Ransomware / malware follows with 5.

Are independent practices in Kentucky at higher risk?

What are Kentucky's breach notification requirements?

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Kentucky healthcare breach data

Latest breach events reported in Kentucky

Kentucky Mountain Health Alliance

Kentucky MSO, LLC

Stewart Home & School

Dermatology Associates

Insurance ACE/Humana Inc.

CenterWell ACE/Home Solutions

Orthopaedic Institute of Western Kentucky

HealthPoint Family Care

Physicians to Children & Adolescents

Dermatology Associates

Jordan Drug, Inc.

Central Kentucky Radiology

Organizations in Kentucky by breach events

Insurance ACE/Humana Inc.

Dermatology Associates

Commonwealth Medical Group

Norton Healthcare

Central Kentucky Radiology

How breaches happen in Kentucky

Kentucky breach notification law

§ 365.732(8) excludes 'person who is subject to HIPAA' — includes CE and BA to the extent each is subject

'Breach' definition in KRS 365.732(1)(a) requires actual/reasonable-belief of identity-theft or fraud harm

2025-2026 currentness note

30 breach events in Kentucky. Is your practice next?

Healthcare breaches in Kentucky

How many healthcare data breaches have been reported in Kentucky?

What is the most common breach mechanism in Kentucky?

Are independent practices in Kentucky at higher risk?

What are Kentucky's breach notification requirements?

Kentucky healthcare breach data

Latest breach events reported in Kentucky

Kentucky Mountain Health Alliance

Kentucky MSO, LLC

Stewart Home & School

Dermatology Associates

Insurance ACE/Humana Inc.

CenterWell ACE/Home Solutions

Orthopaedic Institute of Western Kentucky

HealthPoint Family Care

Physicians to Children & Adolescents

Dermatology Associates

Jordan Drug, Inc.

Central Kentucky Radiology

Organizations in Kentucky by breach events

Insurance ACE/Humana Inc.

Dermatology Associates

Commonwealth Medical Group

Norton Healthcare

Central Kentucky Radiology

How breaches happen in Kentucky

Kentucky breach notification law

§ 365.732(8) excludes 'person who is subject to HIPAA' — includes CE and BA to the extent each is subject

'Breach' definition in KRS 365.732(1)(a) requires actual/reasonable-belief of identity-theft or fraud harm

2025-2026 currentness note

30 breach events in Kentucky. Is your practice next?

Healthcare breaches in Kentucky

How many healthcare data breaches have been reported in Kentucky?

What is the most common breach mechanism in Kentucky?

Are independent practices in Kentucky at higher risk?

What are Kentucky's breach notification requirements?

Latest verified Responses

CareCloud breach filing: what a revised scope means for vendor oversight

Madera Community Hospital breach filing: 150,000 individuals and exfiltration-scoped risk analysis

Brown Health Medical Group breach filing: 311,760 individuals and server-side safeguards