Circle Park Behavioral Health Data Breach 2026: 7,020 South Carolina SUD Treatment Patients Exposed. 42 CFR Part 2 Records. What To Do

What happened

Circle Park Behavioral Health Services is the Florence County Commission on Alcohol & Drug Abuse, a South Carolina county substance use disorder (SUD) treatment authority headquartered at 238 S. Coit Street, Florence, SC. Circle Park provides prevention, treatment, intervention, family therapy, and counseling for alcohol, tobacco, and substance use disorders.

On March 8, 2025, Circle Park detected unusual activity on its network and engaged an independent forensics firm. The investigation found that an unknown actor accessed and exfiltrated data from certain employee email accounts (a business email compromise pattern). The data review concluded on December 23, 2025. Notification letters were mailed on December 30, 2025, and Circle Park filed with state AGs (NH, SC, VT) and HHS OCR on January 14, 2026.

Total affected: 7,020 individuals. South Carolina filing identifies 1,157 SC residents; 1 New Hampshire resident.

42 CFR Part 2 — heightened federal protection for SUD records

Because Circle Park is a federally-assisted SUD treatment program, its records are protected by 42 CFR Part 2 in addition to HIPAA. Part 2 imposes stricter consent and re-disclosure requirements than HIPAA — patients can sue for unauthorized re-disclosure, and OCR began enforcing Part 2 under a unified rule effective February 16, 2026.

Circle Park’s public notice does not explicitly invoke Part 2 by name, which may itself become a focal point in litigation.

What was stolen

• Full name
• Social Security number
• Date of birth
• Driver’s license number, state ID number
• Health insurance information
• Medical treatment and/or history (SUD treatment records, Part 2 protected)

What Circle Park is offering

• 12 months of complimentary IDX credit + CyberScan monitoring
• $1M identity-theft insurance reimbursement
• Fully managed identity recovery
• Enrollment deadline: March 29, 2026 (already passed — check your letter)
• Call center: 1-877-608-6023 (entity-published) / 1-833-788-9712 (aggregator-published)

What to do

1. Enroll in IDX through the activation code in your letter. If the March 29, 2026 deadline has passed, call IDX immediately to request late enrollment.
2. Place free credit freezes at all three bureaus. Full SSN is in scope.
3. File IRS Form 14039.
4. Document any unauthorized re-disclosure of your SUD treatment records — Part 2 gives you stronger private remedies than HIPAA.
5. Stop the ongoing flow of your SUD treatment data. HealthConsent files HIPAA and Part 2 restriction requests so the highly sensitive treatment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches