Anatomic and Clinical Laboratory Associates data breach: a Tennessee pathology group's files downloaded

Why did I get a letter from ACLA?

Many people who get this letter will never have visited ACLA. The letter describes it as a pathology group that serves outpatient surgery centers and physician offices in Tennessee. The letter does not say which centers or offices the affected patients came through. The guide to breach letters from companies you never dealt with explains how that happens.

What happened at ACLA?

ACLA says it opened an investigation, secured its network and worked with outside cybersecurity experts. A review of the files that may have been downloaded ended on April 27, 2026.

Date	What the letter and the regulators' records say
December 1, 2025	ACLA becomes aware of possible unauthorized activity
April 27, 2026	Review of the files ends
June 23, 2026	Report to HHS (169,626); logged in Massachusetts (69 residents)

That is about seven months from detection to the report, and eight weeks from the end of the review. The letter does not say when the access began or ended.

What information was involved?

Anatomic and Clinical Laboratory Associates' sample letter leaves the data items as a placeholder. For the 69 Massachusetts residents in Anatomic and Clinical Laboratory Associates' notice, the state's record marks Social Security numbers and medical records as breached. ACLA says it added security features after the incident.

What information was exposed in the ACLA breach?

The filed sample leaves the list as a placeholder, but The HIPAA Journal reported the items from the notice: each person's name with one or more of date of birth, Social Security number, taxpayer identification number, dates of service, provider names, mental or physical condition, treatment or procedure information, diagnosis or clinical information, medical history, patient account number and medical record number.

Kind of data	Items reported
Identity	Name, date of birth, Social Security number, taxpayer identification number
Clinical	Diagnosis or clinical information, medical history, mental or physical condition, treatment or procedure information
Visit and billing	Dates of service, provider names, patient account number, medical record number

Does everyone who got an ACLA letter get credit monitoring?

No. The HIPAA Journal reported that monitoring and identity protection were offered to certain individuals, depending on the types of their information involved; each letter shows whether it carries an enrollment code. The letters were mailed on June 23, 2026, and the 169,626 were described as current and former patients.

What is ACLA offering?

Item	Detail from the letter
Service	Credit monitoring with alerts, dark web monitoring, credit protection, change of address monitoring, identity restoration and lost wallet help, for the number of months printed on each letter
Provider	Epiq
Enrollment	www.privacysolutionsid.com, with the code and deadline printed on the letter; help on 866.675.2006, Monday to Friday, 9 a.m. to 5:30 p.m. Eastern Time
Questions	866-659-7137, 9:00 a.m. to 9:00 p.m. Eastern Time, Monday to Friday, excluding major U.S. holidays, for 90 days from the letter date

The question line closes 90 days after the letter date. The guide to credit monitoring offers sets Anatomic and Clinical Laboratory Associates' offer beside other letters.

What the documents leave open

• When the unknown actor first got in, and how.
• How many files were downloaded.
• Which surgery centers and physician offices sent the samples or records involved.

With 169,626 people, Anatomic and Clinical Laboratory Associates' report is the 32nd largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.