FQHC Ransomware Surge Q1 2026, Sandhills (169K), Cherry Health (184K), Central Jersey Hit; Class-Action Lawsuits Now Routine
Issue
Comparitech's Q1 2026 healthcare ransomware roundup confirms 201 attacks (120 providers + 81 vendors) — three of which were FQHCs: Sandhills Medical Foundation (SC, 169,017 patients, INC Ransom group), Cherry Health (Michigan's largest FQHC, 184,000 patients), and Central Jersey Medical Center FQHC. Sandhills now faces a class-action investigation announced May 2026, signaling that civil litigation is becoming routine on top of OCR enforcement.
Combined with OCR's April 23 four-entity ransomware sweep ($1.165M), the message to FQHC boards is unambiguous: Security Risk Analysis (45 CFR § 164.308(a)(1)(ii)(A)) is now the single most material ePHI compliance gap. CA FQHCs running OCHIN Epic, eClinicalWorks, NextGen, athenahealth — every IT environment with PHI — should refresh risk analysis before the Section 504 May 11 deadline lands and triggers heightened OCR scrutiny.
Key points
- FQHC ransomware now triggers BOTH OCR enforcement AND civil class-action lawsuits — 2x exposure. Refresh Security Risk Analysis annually + document evidence at minimum
- Three FQHCs hit in Q1 2026 alone — pattern is mid-size FQHCs with limited dedicated cybersecurity. Visualutions, Huntress, KnowBe4 are FQHC-affordable cyber options worth evaluating
- BAA inventory + tested backup-restore procedures pair with risk analysis as the OCR-listed enforcement triad. Score yourself against the 4 settled entities (Apr 23, $1.165M) before OCR scores you
Sources for this story
Comparitech (Q1 2026 Healthcare Ransomware Roundup)Sources for your board packet
This story's source plus 4 related stories and their sources, ready to print for your team or board.
Free. Unlocking the packet subscribes you to Intel Brief. You'll be subscribed right away, with no confirmation email. Unsubscribe with one click in any issue. If you unsubscribed before, we won't re-add you. We never sell your email. You can open each source above without an email.
Part of
- Enforcement: privacy, fraud and audits
Data breaches
FQHC Talent. (2026, May 6). FQHC Ransomware Surge Q1 2026, Sandhills (169K), Cherry Health (184K), Central Jersey Hit; Class-Action Lawsuits Now Routine. Source: Comparitech (Q1 2026 Healthcare Ransomware Roundup). Retrieved October 6, 2026, from https://www.fqhctalent.com/intel/fqhc-ransomware-q1-2026-sandhills-cherry-central-jersey
More in Risk & Compliance
Sep 29
HHS civil rights office says when states can use substance use records
Sep 25
CMS and 37 states pledge to judge Medicaid by health outcomes
Sep 24
Geiger Gibson review finds health centers expect a heavy work-rule frailty burden
Sep 24
CMS seeks input on Part D pharmacy contract terms, including 340B claims