Nation-state-caliber ransomware actors systematically targeting an under-resourced sector. OCR enforcement active. Texas HB 300 layers additional obligations on top of HIPAA. Most Texas hospitals and clinic networks are not prepared.
| Metric | Value | Source |
|---|---|---|
| TX healthcare incident surge | +30% YoY (2025) | THA/Cynerio, 2025 |
| Median ransomware dwell time | 207 days | IBM X-Force 2025 |
| Healthcare breach cost (TX avg) | $9.8M per incident | HIPAA Journal / Patient Protect, 2026 |
| TX breach cost range | $7.42M–$10.3M | IBM Cost of Data Breach 2025; Dialog Health |
| Largest 2024 healthcare breach | 137M+ records | HIPAA Journal |
| ePHI dark web value | 10–50× credit card data | HIMSS / Verizon DBIR |
Data sourced from HHS OCR breach tracker, news reports, HIPAA Journal, and security vendor research. Sources listed at the end of this report.
| # | Date | Entity | Records Affected | Attack Vector | Threat Actor | TX Compliance Failures | Downtime | Est. Cost |
|---|---|---|---|---|---|---|---|---|
| 1 | Jan 31, 2026 | Nacogdoches Memorial Hospital Nacogdoches, TX |
2,576,000+ expanded from 257K |
Internal network compromise via authenticated access; 2-week dwell before detection | Under investigation Jan 2026 |
HIPAA Security Rule: inadequate network monitoring; delayed breach identification; notification gaps | ~14 days |
$8–15M |
| 2 | May 2024 | Ascension Health Multiple TX sites — TX largest footprint state |
~5.6M nationally; TX ~1.2M+ |
Phishing/social engineering → lateral movement to clinical systems; Black Basta suspected | Black Basta (ALPHV affiliate) |
HIPAA Administrative Safeguards: delayed detection; BA network segmentation failures; EHR backup integrity questions | Multiple weeks; ambulances diverted, elective procedures canceled |
$1.1B net loss (Ascension FY2024) |
| 3 | 2024 (disclosed Jan 2025) | Concentra Health Services TX and 40+ states; TX-based |
3,897,000+ (PJ&A third-party breach) |
Compromised vendor: Perry Johnson & Associates (PJ&A) — medical transcription | Unidentified (third-party supply chain) |
BAA cascade liability: Concentra failed to ensure BA compliance; HIPAA Breach Notification Rule violations at both entities | None reported at Concentra; impact at PJ&A |
>$20M across Concentra + PJ&A; class action lawsuits |
| 4 | 2024 | North Texas Behavioral Health Authority Dallas/Fort Worth, TX |
~125,000+ (reported Apr 2026) |
Network intrusion; unauthorized access to behavioral health records | Unidentified |
HIPAA Privacy Rule: unauthorized disclosure of protected mental health records; TX Health & Safety Code Ch. 181 violations | Unknown |
TBD (litigation pending) |
| 5 | 2025 | Heart of Texas Behavioral Health Network McLennan County, TX |
Paper records — count undisclosed |
Physical records incident; unauthorized access to paper files | Unidentified |
HIPAA Privacy Rule: physical safeguard failures; TX TMRPA paper record requirements | Unknown |
TBD |
| 6 | 2023–2024 | Texas Tech University Health Sciences Center Lubbock, TX |
~1,400,000 |
Cyberattack on university health system | Unidentified |
HIPAA Security Rule: educational health record protections; notification obligations | Unknown |
Unknown |
| 7 | 2024 | OpenLoop Health Remote/TX telehealth |
~716,000 |
Network intrusion; telehealth platform exfiltration | Unidentified |
HIPAA Security Rule: telehealth platform security gaps; encryption failures | None reported |
Unknown |
| 8 | 2023 | HCA Healthcare Houston, TX (TX facilities) |
~11M nationally (TX ~1M+) |
Accidental data exposure via misconfigured external system | None (internal misconfiguration) |
HIPAA Privacy Rule: unauthorized disclosure via misconfiguration; internal audit failures | None |
Regulatory settlement |
| 9 | 2025 | Change Healthcare National; TX heavily impacted |
~100M+ nationally |
ALPHV/BlackCat ransomware; identity stolen data including TX patients | ALPHV/BlackCat |
BAA chain: Change is BA to thousands of TX providers; TX provider BAA cascade exposure | 3+ weeks; claims processing halted; TX providers unable to bill |
>$800M direct costs (UnitedHealth); cascading TX provider revenue disruption |
| 10 | 2024 | Perry Johnson & Associates (PJ&A) National; TX providers as clients |
~4M patients (multi-state, TX heavy) |
Network intrusion at transcription services vendor | Unidentified |
BA compliance failures; HIPAA Security Rule for third-party vendor | None reported |
>$10M breach response |
| 11 | 2025 | Regional Dialysis Provider East Texas |
~15,000–30,000 estimated |
Ransomware (specific group undetermined) | Unidentified |
HIPAA Security Rule: limited cybersecurity controls; EHR backup failures | 5–7 days |
$500K–$2M |
| 12 | 2025 | Texas Rural Hospital District TX Panhandle (undisclosed) |
~20,000–40,000 estimated |
Ransomware via remote access vector (RDP/VPN) | Unidentified |
HIPAA Security Rule: no 24/7 SOC; legacy VPN; delayed detection | 10+ days; patient transfers |
~$1–3M |
Note: Incident counts 11–12 based on THA member reports and THA cybersecurity survey data, not public disclosures. Records affected estimated from industry benchmarks for similar-size organizations.
| Requirement | HIPAA (Federal) | TX HB 300 / TMRPA |
|---|---|---|
| Notification timeline | 60 days from discovery | 60 days from discovery (aligned, but enforcement differs) |
| Enforcement | HHS OCR (civil) | Texas AG (civil) — private right of action exists |
| Who must notify | Covered entities + BAs | Same; includes any person maintaining health info on behalf of a facility |
| Penalty per violation | $100–$50,000 (willful: $1.5M max/year) | Similar — stacks with HIPAA — double exposure per incident |
| Scope of data | ePHI only | Broader: includes health info in any form (paper, oral) |
| Records retention | 6 years (Security Rule) | Until death + 25 years (TX Health & Safety Code 181.121) |
| Scope of damages | Civil only | Civil + criminal (if negligent/intentional) |
Double-Jeopardy Risk: A single breach at a Texas hospital can trigger simultaneous OCR investigation (federal) and Texas AG enforcement action (state) — with separate penalty frameworks, separate legal defense costs, and separate notification obligations that must be coordinated to avoid inconsistency.
HHS OCR Enforcement (2024–2026):
RaaS model; exploited stolen credentials + unpatched VPN/exposed services; exfil-first (steal data before encryption). Hospitals pay fastest — patient care pressure creates urgency. Change Healthcare: $22M ransom.
Phishing + compromised credentials; targets EHR and backup systems specifically; prefers "big game" healthcare targets. Uses sophisticated detection evasion. Active throughout 2025–2026.
Phishing, exploit kits, C2 infrastructure; known for targeting schools + healthcare. Double-extortion standard; exfils ePHI and threatens public leak. Has targeted regional health systems — fits the TX rural hospital profile.
Phishing → credential stuffing → lateral movement via legitimate tooling (Mimikatz, Cobalt Strike). Extended dwell time (aligned with 207-day median). Targets backup systems to prevent recovery; exfil-first.