Skip to content

← All developments

OCR HIPAA Breach Portal · September 25, 2026 · Primary source

OCR HIPAA Breach: Kostelic and Associates 3PLLC, NC, 535 affected, Hacking/IT Incident

Score 51PRIMARYregulatoryHHS OCRHIPAA

Summary

Kostelic and Associates 3PLLC, a North Carolina healthcare provider, reported a HIPAA breach to HHS OCR on September 25, 2026, affecting 535 individuals via a hacking or IT incident targeting email systems. No business associate was involved. The breach is publicly listed under HITECH Act Section 13402(e)(4), and OCR resolution agreements or civil monetary penalties may follow.

What this may mean

The hacking classification triggers OCR's investigative posture for incidents affecting 500 or more individuals under HITECH Act Section 13402(e)(4). The affected entity is a small single-state provider with 535 individuals affected, limiting broader precedential or systemic impact.

Informational only. Not legal, medical, financial, or other professional advice. Always consult a qualified professional familiar with your specific facts before relying on any item.

Related items