AdventHealth Daytona Beach Data Breach 2026: 821 Outpatient Lab Patients Exposed by Construction Workers. Paper Records Lost. What To Do

What happened

AdventHealth Daytona Beach (formerly Florida Hospital Memorial Medical Center) is a Florida acute-care community hospital operated by AdventHealth, a non-profit faith-based health system. The hospital is currently undergoing a $220M expansion project, slated for completion in fall 2026.

This is not a cyber incident. During a departmental relocation of the outpatient laboratory from the first floor to the second floor, construction workers installing a new pneumatic tubing system accessed and discarded paperwork in an area containing outpatient lab orders. The orders were physically thrown away by construction workers — not stolen, not hacked, not misplaced by hospital staff.

The outpatient lab orders covered patient service dates from September 1 to September 14, 2025. The loss was identified by the outpatient laboratory team on November 25, 2025. AdventHealth Daytona Beach filed with HHS OCR on January 20, 2026 — within HIPAA’s 60-day notification window — confirming 821 affected individuals.

This is a process-failure breach, not a malicious one. But the contractor-coordination failure is a recurring pattern in healthcare facilities undergoing expansion.

What was on the lost paperwork

Per the entity’s notice:

• Full name, home address, date of birth
• Telephone number, email address
• Diagnosis codes
• Health condition(s)
• Health insurance policy number

Explicitly NOT in scope: Social Security number, financial account information, driver’s license. Lab orders typically don’t carry SSNs, which materially limits identity-theft exposure.

The diagnosis-code exposure is genuinely sensitive: ICD-10 codes can disclose specific medical conditions to anyone who recovers the paperwork or finds it in waste streams.

What AdventHealth Daytona Beach is offering

Public reporting does not mention credit monitoring or a dedicated call center. Given (a) no SSN or financial data was exposed and (b) AdventHealth stated “no evidence the lab orders were or will be misused,” credit monitoring was likely not offered. Standard practice for paper-records breaches without SSN exposure is a notice letter plus process improvements, not Experian or IDX coverage.

If you received a notification letter, it will list any monitoring offered and the dedicated response line.

What to do

1. Read your specific notification letter to confirm what data elements were involved in your case.
2. Pull free copies of your medical records from AdventHealth Daytona Beach for the September 1-14, 2025 service window — confirm the diagnoses and lab orders on file match your expected care.
3. Be alert to social engineering referencing your specific September 2025 lab visit details — that level of context combined with public name + address could lend credibility to phishing.
4. Watch your insurance Explanation of Benefits statements for unfamiliar lab claims.
5. Stop the ongoing flow of your hospital lab records. HealthConsent files HIPAA restriction requests so the diagnostic and lab order data exposed in this breach is not continuously re-shared through claims and HIE pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches