Last month, a colleague in a healthcare compliance Slack asked: "We just got breach notification letters from a vendor. Our legal team is freaking out. What's the actual playbook here?" This question came from a DPO at a mid-sized hospital system whose diagnostic lab partner had disclosed unauthorized access affecting over half a million patients.
That vendor was Centers Lab NJ LLC, which reported the incident to HHS' Office for Civil Rights after discovering that an unauthorized party accessed its systems between August 9, 2025, and August 14, 2025. The breach involved names, dates of birth, Social Security numbers, medical information, and health insurance data for 542,377 individuals. The Worldleaks threat group later claimed responsibility and published the stolen data.
The questions that followed in that Slack thread mirror what I hear from DPOs every time a healthcare breach hits the news. Here's what you're actually asking, and what the Centers Lab incident reveals about your obligations.
Do You Need a Third-Party Forensic Team?
Yes, you do. Your incident response plan under the HIPAA Security Rule (45 CFR § 164.308(a)(6)) requires an accurate assessment of the breach's nature and scope. Your IT team knows your systems, but they're not neutral investigators and are likely overwhelmed.
Centers Lab engaged third-party forensic investigators to determine the access timeline and what data was exfiltrated. They then brought in data review specialists to analyze the impacted files. This two-phase approach is essential: technical forensics to reconstruct the attack, then data specialists to identify whose information was compromised.
Your incident response retainer should include both. When negotiating contracts, specify that the forensic firm will provide a written report suitable for regulatory submission. HHS expects you to document your investigation methodology, not just your conclusions.
How Long Do You Have to Identify Affected Individuals?
The Health Information Technology for Economic and Clinical Health Act requires notification "without unreasonable delay and in no case later than 60 calendar days" after discovering a breach. "Discovery" means when you knew or should have known a breach occurred, not when you finish your investigation.
Centers Lab discovered suspicious activity on August 25, 2025, eleven days after the unauthorized access ended. Their notification letters went out after completing the data review validation process. You can't notify individuals until you know which individuals were affected and what specific data elements were compromised.
The 60-day clock starts when you have sufficient evidence of a breach, but HHS recognizes that complex investigations take time. Document every step: when you engaged forensics, when they delivered preliminary findings, when data review began, and when validation finished. If you're approaching day 50 and still validating records, contact HHS and explain your timeline. They're more forgiving of documented delays than silent ones.
What Should You Offer Affected Individuals?
The HIPAA Breach Notification Rule (45 CFR § 164.404) requires you to describe what happened, what information was involved, what steps you've taken, what individuals should do, and how they can contact you. It doesn't mandate credit monitoring.
However, if Social Security numbers were exposed, offer credit monitoring. Centers Lab provided 12 to 24 months of complementary services, likely reflecting risk stratification. Individuals whose SSNs and medical information were both compromised probably received 24 months; those with less sensitive combinations got 12.
Your legal counsel may push for the minimum. Your risk management team should push for the maximum you can afford. The Worldleaks group published this data on the dark web, meaning every affected individual faces ongoing identity theft risk. Offering robust monitoring services isn't just good PR; it's evidence of your effort to mitigate harm, which matters if you face civil litigation or an HHS investigation.
Should You Disclose a Threat Actor's Claim?
Centers Lab didn't mention Worldleaks in their public disclosure, but the threat group published the data anyway. You're not required to name the attacker, but you must provide "a brief description of what happened, including the date of the breach and the date of the discovery of the breach."
If the threat actor has published your data, affected individuals need to know their information is actively circulating. You don't have to name the group, but your notification should reflect the severity: "We have reason to believe the data has been published online" is more honest than "an unauthorized party may have accessed files."
Your notification language should match your risk assessment. If forensics confirms exfiltration but you have no evidence of publication, say that. If the data appeared on a leak site, say that. HHS can subpoena your forensic reports; if your notifications downplay risks that your investigation documented, you've got a credibility problem.
What Do "Additional Data Security Measures" Mean?
Every breach notice includes this phrase, and it's usually meaningless. Centers Lab said they implemented additional measures after the incident and stressed they had "strong cybersecurity measures" beforehand. That's lawyer-approved language that tells affected individuals nothing.
What you should actually do: review your technical safeguards under 45 CFR § 164.312. If the attacker used compromised credentials, implement multi-factor authentication for remote access. If they moved laterally through your network, segment your systems. If they exfiltrated data undetected for five days, deploy data loss prevention monitoring.
Document these changes in your risk analysis and update your policies. When HHS investigates, they'll compare your pre-breach controls to your post-breach controls. If you claimed you had strong measures before but made significant changes after, you're admitting your prior controls were inadequate.
What's Your Liability if a Vendor Breaches?
You're still a covered entity responsible for the protected health information. Under the HIPAA Omnibus Rule, you must have a business associate agreement (BAA) in place that requires the vendor to report breaches to you. Centers Lab's clients, the healthcare providers who sent specimens for testing, are the ones legally obligated to notify patients.
Review your BAA. It should specify that the vendor notifies you "without unreasonable delay" and provides sufficient detail for you to meet your own notification obligations. If Centers Lab is your vendor, they've now given you the information you need: the timeline, the data elements, and the individual count.
Your compliance team needs to determine whether your organization's patients are among the 542,377 affected. If so, you're sending your own notification letters. You can explain that your vendor experienced the breach, but you're the entity patients trust with their data, and you're the entity HHS will hold accountable.
Next Steps
Start with your incident response plan. If you don't have a tested plan that includes forensic vendor contacts, data review procedures, and notification templates, build one now. The NIST Cybersecurity Framework 2.0 Respond function (RS) provides a structure: detection, analysis, containment, eradication, recovery, and lessons learned.
Then stress-test your business associate agreements. Can your vendors detect unauthorized access within days, not weeks? Do they have forensic response capabilities, or will they be scrambling to find help while the clock runs? Do they understand that "strong cybersecurity measures" isn't a legal defense?
The Centers Lab breach affecting 542,377 individuals isn't an outlier. It's a reminder that your third-party risk management program is only as strong as your weakest vendor's incident response capability. When that Slack question comes in, you should already know the answer.
