HIPAA Journal reports Accumedic EHR vendor incident hit NY counselling patients

What happened

According to HIPAA Journal, Hispanic Counseling Center and Brooklyn Counseling Services in New York have notified patients that some of their personal and health information was compromised in a security incident at their electronic medical record vendor. This advisory is based on a single outlet’s report of the notification letters. The total number of affected people is not confirmed, and there has been no independent verification.

Hispanic Counseling Center. HIPAA Journal reports what the practice’s notification letters say:

• Detection: its EHR vendor, Accumedic Computer Systems, detected suspicious activity on its network on June 8, 2026.
• First access: after an investigation with third-party cybersecurity experts, the vendor concluded on August 7, 2026 that an unauthorized third party first accessed its network on April 8, 2026.
• Data window: the third party potentially obtained customer information between June 4 and June 8, 2026.
• Confirmation: on September 1, 2026, Accumedic confirmed that patient health information had been exposed and was potentially obtained.
• Data types: names, dates of birth, Social Security numbers, medical information and health insurance information (HIPAA Journal).

The vendor says it has implemented additional technical safeguards. Hispanic Counseling Center began notifying patients on October 30, 2026, and its letters offer complimentary credit monitoring. The number of affected individuals had not been publicly disclosed when HIPAA Journal published (HIPAA Journal).

Brooklyn Counseling Services. This practice operates formally as BCS Group and is also known as BCS Counselling Group. According to HIPAA Journal, it said the incident affected one of its electronic medical records vendors.

• Data types: the letters list names, email addresses, phone numbers, dates of birth, Social Security numbers and health records, varying by individual.
• Affected people: state attorneys general were notified. One Massachusetts resident and two Vermont residents were affected, but the total has not been disclosed.
• Vendor not named: the letter seen by HIPAA Journal does not name the vendor or say when the incident occurred. HIPAA Journal says the timing suggests the same vendor, Accumedic, but this is the outlet’s inference and is not confirmed.

Several details are not confirmed:

• how the attacker got in
• how much data was taken
• who was responsible
• whether other Accumedic customers are affected

Am I affected?

• Patients: you may be affected if you are or were a patient of Hispanic Counseling Center (Long Island) or Brooklyn Counseling Services / BCS Group and received a notification letter (HIPAA Journal).
• Providers: HIPAA Journal describes Accumedic as offering EHR software for behavioral health providers. Whether other Accumedic customers are affected is not confirmed.

What to do now

1. Read your letter. If you received a notification letter, check which data types it lists for you.
2. Enrol in credit monitoring. Use the complimentary credit monitoring offered in the Hispanic Counseling Center letters (HIPAA Journal). For Brooklyn Counseling Services, whether an offer exists is not confirmed, so check your letter.
3. Watch your accounts. Because Social Security numbers and health insurance information are listed, keep an eye on your credit reports and insurance statements for activity you do not recognise.
4. If you are a provider using Accumedic, ask the vendor directly whether your organisation’s data falls within the reported incident.

Sources

• HIPAA Journal: Security Incident at EHR Vendor Affects Patients of New York Counselling Practices