Your Health Data Was Breached: What to Do Next

The envelope looks like junk mail. Inside is a letter from a hospital, lab, insurer or billing company you may barely remember, saying your information “may have been involved” in a security incident. It lists your name, maybe your Social Security number, your insurance ID and something vague about “health information.”

Healthcare breaches are common, and some are huge. The 2024 cyberattack on Change Healthcare alone eventually affected an estimated 190 million-plus people, according to the company’s reports to federal regulators. So if you’ve received a letter, you’re far from alone, and there’s a clear set of steps that limits the damage.

This guide walks through what to do in the first hour, the first week and the months that follow. This is general information, not legal advice.

What a breach letter means

Under the HIPAA Breach Notification Rule, health plans, providers and their business associates must notify you without unreasonable delay, and no later than 60 calendar days after discovering a breach of unsecured health information. If more than 500 residents of a state are affected, they must also notify local media, and breaches affecting 500 or more people are reported to HHS, which posts them on its public breach portal.

A proper notice should tell you:

• What happened and when
• What types of information were involved
• What you should do to protect yourself
• What the organization is doing about it
• How to contact them, usually including a toll-free number

If the organization is a health app or other company that isn’t covered by HIPAA, a similar FTC rule may require notice instead. Our guide on whether your health app is covered by HIPAA explains the difference.

First, verify the letter and assess the damage

Step 1: Confirm the letter is real

Scammers send fake breach notices to get you to call a fraudulent number or click a link. Before you act:

• Don’t use contact details only from the letter if anything feels off. Look up the organization’s phone number on its official website or your insurance card.
• Check the HHS breach portal for large breaches. Note that HHS posts breaches after verification, so a brand-new incident may not show up yet.
• Never give your full Social Security number, passwords or bank details to someone who calls you about a breach.

Our guide to spotting phishing emails covers the warning signs that also apply to breach-themed texts and calls.

Step 2: Figure out what was exposed

Your next steps depend on the type of data. Read the letter carefully, then use this table.

Key takeaway: A stolen insurance ID is the one most people forget. Credit monitoring won’t catch someone using your health plan, so your Explanation of Benefits statements become your early warning system.

Protect your credit and identity

Step 3: Enroll in the free protection offered

Many breached organizations offer free credit monitoring or identity protection, often for 1 or 2 years. It’s usually worth enrolling, with 2 caveats:

• Sign up through the organization’s official instructions and enrollment code, not a link from an unexpected email.
• Monitoring tells you about problems after they start. It doesn’t prevent new accounts. That’s what a credit freeze is for.

Note the enrollment deadline. Many offers expire within a few months of the letter.

Step 4: Freeze your credit and consider a fraud alert

If your Social Security number was exposed, a credit freeze is the single strongest step. According to the FTC:

• A credit freeze is free, lasts until you lift it, and doesn’t affect your credit score. You must contact each of the 3 bureaus (Equifax, Experian and TransUnion) separately.
• An initial fraud alert is free, lasts 1 year and can be renewed. Contacting 1 bureau is enough; it must tell the other 2.
• An extended fraud alert lasts 7 years and is available if you’ve filed an identity theft report with the FTC or police.

Our step-by-step guide on how to freeze your credit covers each bureau’s process. You can lift a freeze temporarily when you apply for a loan or new account.

While you’re at it, check your credit reports for accounts you don’t recognize at AnnualCreditReport.com, the official free source. If you find errors, see how to dispute a credit report error.

Step 5: Watch for medical identity theft

Medical identity theft happens when someone uses your name or insurance to get care, prescriptions or equipment, or to file false claims. Besides the cost, it can put wrong information, like someone else’s blood type or diagnosis, into your medical record.

The FTC recommends these checks:

1. Read every Explanation of Benefits (EOB). Your insurer sends one after each claim. Confirm the provider name, dates of service and services match care you actually got.
2. Check your insurer’s online portal for claims history; it often updates faster than mailed statements.
3. Look at medical bills and collection notices for providers you’ve never visited.
4. Request an accounting of disclosures. HIPAA lets you ask each provider and plan for a list of certain disclosures of your information. You can get 1 free copy every 12 months from each.
5. Get copies of your medical records from affected providers and look for treatments, allergies or diagnoses that aren’t yours.

If you’re on Medicare, review your Medicare Summary Notice the same way. Our guide to reading a medical bill explains how to match EOBs, bills and codes.

Secure your accounts and report misuse

Step 6: Secure your accounts

Health portals are a common follow-on target. Take 15 minutes to:

• Change the password on the affected portal and anywhere you reused it
• Turn on two-factor authentication for patient portals, insurer accounts and email (see how to set up two-factor authentication)
• Use a password manager so every account has a unique password
• Check the portal’s contact info so alerts reach your current email and phone

Step 7: If your information is misused, report it and fix records

If you spot fraud, act quickly:

1. Report it at IdentityTheft.gov. The FTC site creates an official Identity Theft Report and a personalized recovery plan.
2. Call your insurer’s fraud department about any claims you didn’t make.
3. Contact each provider involved and ask for your records and the fraudulent bills. HIPAA gives you the right to request corrections (called amendments) to your record. Send the request in writing, include a copy of your Identity Theft Report, and keep copies.
4. Dispute fraudulent medical debts with the provider, the collector and the credit bureaus.
5. File a complaint with HHS if a provider won’t give you access to your records. The FTC notes you can do this if you don’t get your records, or an explanation, within 30 days of a written request.

If someone threatens to publish your health information unless you pay, don’t pay. Report it to the FBI’s Internet Crime Complaint Center (IC3) and to the organization that was breached.

Where to start: your breach response checklist

Here’s the order to work in:

Today - Confirm the letter is real using an independent phone number - Note exactly what data was exposed - Change any affected portal passwords

This week - Freeze credit at all 3 bureaus if your SSN was exposed - Enroll in the offered monitoring - Request an IRS Identity Protection PIN if your SSN was exposed - Tell your insurer if your member ID was exposed

Every month for the next year - Review EOBs, insurer claims and Medicare statements - Glance at your credit reports - Stay skeptical of calls, texts and emails that mention the breach

For a broader plan covering non-health breaches, see what to do after a data breach and how to protect yourself from identity theft.

Can you sue or get compensation?

Large breaches often lead to class-action lawsuits, and settlements sometimes offer cash payments, reimbursement for documented losses, or extra monitoring. You’ll usually learn about them through a settlement notice or an official settlement website. Keep receipts for any out-of-pocket costs, like postage, fees or time off work. HIPAA itself doesn’t give individuals a right to sue, but you can file a complaint with the HHS Office for Civil Rights. Talk to a licensed attorney if you have significant losses.

Conclusion

A health data breach letter is unsettling, but most of the risk can be managed with a few focused steps. Confirm the notice is real, figure out what was exposed, freeze your credit if your SSN was taken, and treat your Explanation of Benefits statements as your main defense against medical identity theft. Secure your portal accounts, report any misuse at IdentityTheft.gov, and keep watching your statements for at least a year.

Sources

• HHS: HIPAA Breach Notification Rule — 60-day notice deadline, media notice and HHS reporting thresholds
• HHS: Change Healthcare cybersecurity incident FAQ — federal updates on the Change Healthcare breach
• FTC: What to know about medical identity theft — EOB reviews, record requests, corrections and reporting
• FTC: Credit freezes and fraud alerts — free freezes, 1-year and 7-year fraud alerts
• FTC: Medical identity theft FAQs for providers and health plans — accounting of disclosures, 1 free copy every 12 months