FQHC Ransomware Surge Q1 2026 — Sandhills (169K), Cherry Health (184K), Central Jersey Hit; Class-Action Lawsuits Now Routine

Comparitech's Q1 2026 healthcare ransomware roundup confirms 201 attacks (120 providers + 81 vendors) — three of which were FQHCs: Sandhills Medical Foundation (SC, 169,017 patients, INC Ransom group), Cherry Health (Michigan's largest FQHC, 184,000 patients), and Central Jersey Medical Center FQHC. Sandhills now faces a class-action investigation announced May 2026, signaling that civil litigation is becoming routine on top of OCR enforcement. Combined with OCR's April 23 four-entity ransomware sweep ($1.165M), the message to FQHC boards is unambiguous: Security Risk Analysis (45 CFR § 164.308(a)(1)(ii)(A)) is now the single most material ePHI compliance gap. CA FQHCs running OCHIN Epic, eClinicalWorks, NextGen, athenahealth — every IT environment with PHI — should refresh risk analysis before the Section 504 May 11 deadline lands and triggers heightened OCR scrutiny.