The Concord Eye Center breach shows that a small practice needs three things ready before an incident: a named incident response contact, a current map of where patient data lives, and a written notification timeline. Attorneys were seeking affected patients one day after the attackers posted. Four days later, the practice still says its review may take weeks.
Concord Eye Center is an ophthalmology practice in Concord, New Hampshire. Its homepage now carries a notice, with no date on it, that begins: "We recently discovered a cybersecurity incident impacting a limited portion of our network environment." The notice says the practice "immediately retained a team of forensic experts," that "all essential services continued without interruption," and that "our comprehensive assessment is ongoing and may span several weeks."
Concord Eye Center made the right first moves: it brought in forensic experts and kept patient care running. The lesson here is about speed, and about who else starts a clock once an incident is public.
The Concord Eye Center Breach Timeline
The Interlock ransomware listing claims the stolen files include patient names, addresses, dates of birth, Social Security numbers, medical histories, diagnostic results, and billing and insurance records. These are the attackers' claims. The practice has not confirmed them.
The listing also quotes the law at the practice. It says leaking the files "would primarily violate the HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)" and the HITECH Act. Here the attackers used HIPAA itself as pressure, because HIPAA comes with deadlines.
Put the dates side by side. The attackers posted on their leak site on October 12, attorneys were looking for patients for a possible class action data breach lawsuit on October 13, and the practice says its own review may take weeks.
Two Public Trackers That Spread the News
Two free public websites show how fast a healthcare data breach like this becomes news. Neither one needs the practice's permission.
- Ransomware.live watches the ransomware gangs' leak sites on the dark web. It "passively monitors ransomware groups' Data Leak Sites (DLS)." "Several times a day, the platform visits every known leak site and keeps a copy of the page." It adds: "Nothing is downloaded from the victims, and no stolen files are ever collected." The October 12, 15:49 UTC time in the timeline above comes from it, and the ClassAction.org page cites it by name.
- The HHS Office for Civil Rights Breach Portal (sometimes called the HHS wall of shame) is where a practice files its own breach report, and its "View HIPAA Breach Reports" list is open to anyone. HHS says its Office for Civil Rights "investigates all breaches of protected health information (PHI) and Part 2 records that affect 500 or more individuals." Under 45 CFR 164.408, a breach of 500 or more people is reported to HHS at the same time patients are notified.
Ransomware.live put this practice's name in public on the attackers' schedule. The HHS portal is where the practice's own report goes, on the HIPAA clock.
Why the Investigation Does Not Set the HIPAA Deadline
The HIPAA Breach Notification Rule starts its clock at discovery, not at the end of the forensic report. Under 45 CFR 164.404(a)(2), a breach "shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity."
From that day, 45 CFR 164.404(b) requires notice "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." Sixty days is the outer limit, not a grace period.
The rule also sets the default answer. Under 45 CFR 164.402, an impermissible acquisition, access, use, or disclosure of P.H.I. (Protected Health Information) "is presumed to be a breach" unless the practice shows "a low probability that the protected health information has been compromised," based on a HIPAA breach risk assessment of at least four factors. And under 45 CFR 164.414(b), the practice carries "the burden of demonstrating that all notifications were made as required by this subpart."
In plain words: the practice has to prove it either notified on time or did not need to. A forensic review that runs for weeks does not pause any of that. This is educational information, not legal advice. Your attorney should guide how these rules apply to a specific incident.
Lesson 1: Name an Incident Response Contact Before You Need One
The Security Rule requires an incident response plan in all but name. Under 45 CFR 164.308(a)(6)(i), a covered entity must "implement policies and procedures to address security incidents." The next paragraph, 45 CFR 164.308(a)(6)(ii), spells out the work: spot and respond to incidents, limit the harm where you can, and write down what happened and how it ended. Under 45 CFR 164.308(a)(2), it must "identify the security official" responsible for those policies: your HIPAA security officer.
A name in a policy binder is not enough on the morning your practice shows up on a leak site. Ready looks like this:
- One person who leads the response, and a backup for when that person is out.
- A printed contact sheet with your IT provider, your cyber insurance carrier's claims line, and an attorney who handles breaches. Print it, because ransomware can lock the computers that hold the phone numbers.
- A rule for who talks to patients, staff, and reporters, so nobody guesses.
Lesson 2: Keep a Current Map of Where Patient Data Lives
The first question after an attack is what lived on the systems that were hit. The breach risk assessment in 45 CFR 164.402 starts with "the nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification." You cannot answer that quickly without knowing where the data is.
The Security Rule already asks for that knowledge. Its risk analysis (what most people call a HIPAA risk assessment), under 45 CFR 164.308(a)(1)(ii)(A), has to be "an accurate and thorough assessment" of the risks to the electronic patient data your practice holds. You cannot assess data you have not found. Data mapping is how you get there: a data map is the working list behind that assessment.
Keep it to one page per system:
- The system: your EHR (electronic health record), billing, email, shared drives, scanners and imaging, and backups.
- What patient data it holds, such as names, dates of birth, Social Security numbers, insurance, and clinical notes.
- Who can reach it, inside the practice and out.
- Which vendors keep a copy, and whether each one has a signed BAA (business associate agreement).
Update it when you add a system or a vendor. A map from last year leaves out every system and vendor you added since.
Lesson 3: Write the Notification Timeline Now
The deadlines are fixed by rule, so they can be written down before anything happens. This is the federal floor:
Your state's data breach notification law may add its own rules and timing. Put them on the same page, with your attorney's help, and leave blanks for the dates: discovery day, day 60, and the date each notice went out. When the day comes, you fill in blanks instead of researching deadlines.
What a Small Practice Can Do This Week
- Write a name next to "incident lead," and a second name next to "backup."
- Print the contact sheet and keep one copy away from the office computers.
- List every system that holds patient data, and every vendor that keeps a copy.
- Add the notification deadlines above to your incident procedure, with blank date fields.
- Run a 30-minute incident response tabletop exercise with one question: "Our name is on a leak site this morning. Who calls whom?"
If none of this is written down at your practice yet, start with the first item on that list today.
Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg, C.H.P., to get your plan set up, with no per-user fees. See how it works or start with a free 30-minute intro call. No obligation, no pressure.
Sources
- Concord Eye Center homepage notice "Potential Cybersecurity Incident" (read October 16, 2026)
- Ransomware.live listing: Concord Eye Center, Interlock (discovered 2026-10-12 15:49 UTC)
- Migliaccio & Rathod LLP, "Concord Eye Center Data Breach Investigation" (October 13, 2026)
- ClassAction.org, "Concord Eye Center Cyberattack" (last updated October 13, 2026)
- Ransomware.live, "About Ransomware.live" (read October 16, 2026)
- HHS Office for Civil Rights Breach Portal (read October 16, 2026)
- 45 CFR 164.402 (definitions, breach)
- 45 CFR 164.404 (notification to individuals)
- 45 CFR 164.406 (notification to the media)
- 45 CFR 164.408 (notification to the Secretary)
- 45 CFR 164.414 (burden of proof)
- 45 CFR 164.308 (administrative safeguards)
Related Reading