The Center for Bone and Joint Surgery of the Palm Beaches is a Florida healthcare provider that has reported a data security incident to the federal government. Patients trust medical practices with some of their most sensitive information, and when a provider’s systems are compromised, the people affected deserve a clear explanation of what happened and what it means for them.
Center for Bone and Joint Surgery of the Palm Beaches’s Data Breach Investigation
The Center for Bone and Joint Surgery of the Palm Beaches submitted a breach report to the U.S. Department of Health and Human Services Office for Civil Rights on September 25, 2026. The federal breach portal lists the organization as a Florida healthcare provider and classifies the incident as a hacking or IT incident. It identifies the location of the breached information as a network server and other, and it records 5,461 individuals as affected.
Only organizations covered by federal health privacy law appear on that portal, and only when a breach affects 500 or more people. That the practice’s report appears there means it determined the incident met the threshold for federal notification. The portal summary is brief by design. It gives the type of incident, the kind of system involved and the number of people affected, but it does not describe how the intruder got in, when the activity began, or which categories of patient information were involved.
As of this writing, the practice has not published a detailed public explanation that we were able to locate, and the federal listing does not include the dates of the incident or its discovery. For that reason this page does not state when the intrusion occurred or how long it lasted. We will not guess at those details. When the practice or a regulator makes them public, they can be added.
A hacking or IT incident, in the terminology of the federal portal, generally refers to unauthorized access to or acquisition of information through a technical attack, such as malware, ransomware or a compromised account. A network server is the central system where an organization stores shared files and records. The listing therefore indicates that the affected information was held on the practice’s network infrastructure, but it does not say which records were stored there or what an intruder was able to see or copy. Those answers normally come later, in notification letters sent to the individuals involved.
Orthopedic and other specialty medical practices keep records that can combine identity details with treatment information. A single patient file may hold a name, address, date of birth, insurance details and notes about injuries, procedures or imaging. This is a general description of what practices of this kind commonly maintain, and not a confirmed finding about what was exposed here. It does explain why healthcare providers are frequent targets: records of this sort can support identity theft, insurance fraud and convincing phishing messages that refer to real appointments or providers.
Federal rules require covered healthcare providers to notify affected individuals without unreasonable delay after discovering a breach, and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to federal regulators and, in many cases, announced to the media. Many states, including Florida, add their own notification requirements. A federal report submitted on September 25, 2026 suggests that notification letters may be sent to patients around this time, though the portal itself does not confirm when or whether letters have gone out.
If you have been a patient of the practice, watch your mail for a notice that identifies what happened and what information was involved in your own case. Keep any such letter. It is typically the most reliable source for the specifics of your situation and often explains any protection services being offered. If you believe you may be affected but have not received a notice, you can contact the practice directly to ask.
Because the public record on this incident is limited, the 5,461 figure should be understood as the number reported to federal regulators and not necessarily a final total. Breach counts are sometimes revised as an organization completes its review, so the number may change. This page will reflect only what the practice and regulators have made public, and where a detail has not been disclosed, we say so rather than speculate.
When Did This Breach Occur?
The practice submitted its breach report to the U.S. Department of Health and Human Services on September 25, 2026. The federal listing does not state when the unauthorized access began, when it was discovered or how long it continued. Those dates have not been publicly disclosed in the sources reviewed for this page.
What Information Was Breached?
The federal breach portal does not list the categories of information involved. It states only that the incident was a hacking or IT incident involving a network server and other locations, and that 5,461 individuals were affected. The practice has not publicly confirmed which types of personal or health information were exposed. Affected individuals should rely on the notice they receive from the practice for the specifics of their own situation, and should not assume any particular data type was or was not involved.
What You Can Do
If you may be affected by this incident, consider these steps:
- Review your financial account statements and credit reports for activity you do not recognize.
- Place a security freeze or fraud alert with Equifax, Experian and TransUnion.
- Request your free annual credit reports at annualcreditreport.com.
- Review explanation-of-benefits statements and provider bills for services you did not receive.
- Report suspected fraud to law enforcement, the Federal Trade Commission and your state Attorney General.
- Keep any notification letter you receive and follow the instructions it contains.
File a Data Breach Lawsuit Against Center for Bone and Joint Surgery of the Palm Beaches
If you received notice that your information may have been exposed in the Center for Bone and Joint Surgery of the Palm Beaches data breach, you may be entitled to compensation. Healthcare providers that hold sensitive personal and medical information are expected to take reasonable steps to protect it, and people affected by a breach can face a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
