Home > Security Guides > What to Do If Your Medical Information Was Exposed in a Data Breach

What to Do If Your Medical Information Was Exposed in a Data Breach

If a breach exposed your health or insurance data, these steps help you spot medical identity theft, fix your records and use your HIPAA rights.

m00s3c
November 11, 2026
November 11, 2026

Health data breaches rarely stop at names and email addresses. Amplifon Americas says an unauthorized party copied files containing health, insurance and ID data for about 1.33 million people, and a threat actor now claims to hold patient records and Social Security numbers from Medina Regional Hospital. You can cancel a credit card. You cannot cancel your diagnosis, your blood type or your insurance history. That makes the real risk medical identity theft: someone uses your insurance or patient details to get care, prescriptions or payouts, and their information can end up mixed into your medical file.

This guide walks you through what to do after a breach notice says your medical information was exposed, in the order that protects you fastest. It covers U.S. federal rules under HIPAA, the federal health privacy law. Your state may give you extra rights, and nothing here is legal advice.

Step 1: Read the breach notice and list exactly what was exposed

Under the HIPAA Breach Notification Rule, a covered health provider or health plan has to notify you without unreasonable delay and no later than 60 days after it discovers a breach. The notice must describe what happened, which types of information were involved, the steps you should take and how to contact the organization. Write down every data type it names, such as diagnoses, treatment details, insurance member IDs, Medicare numbers, Social Security numbers or bank details.

If you are not sure the letter is genuine, do not call the number printed on it until you have checked it. Our guide on how to tell if a breach notification letter is real shows how. Breaches affecting 500 or more people are listed on the HHS Office for Civil Rights portal at ocrportal.hhs.gov/ocr/breach/breach_report.jsf, and you can also search the BreachNews HIPAA breach tracker.

What success looks like: a short written list of the exposed data types, the date of the breach and a verified contact number for the organization.

Step 2: Tell your insurer and lock down your member ID

Call your health insurer using the number on your insurance card or statements, not one from an email or text. Tell the fraud or member services team that your member ID was in a breach, ask them to note it on your account and ask whether they can issue a new member ID and card.

Medicare: call 1-800-MEDICARE (1-800-633-4227). TTY users can call 1-877-486-2048.
Medicaid: contact your state Medicaid office, which you can find through medicaid.gov.
Patient portals: change the password on the hospital or clinic portal named in the notice, and on any other site where you reused it. Turn on two-factor authentication if the portal offers it. The BreachNews password generator can create a strong replacement.

What success looks like: your insurer has a note on file, you know whether a replacement card is coming, and every health portal you use has a new, unique password.

Step 3: Check every claim and Explanation of Benefits

Your Explanation of Benefits, the statement your insurer sends after each claim, is the fastest place to spot medical identity theft. Sign in to your insurer’s website or app, open the claims history and go back at least to the breach date. Look for visits, providers, prescriptions, equipment or dates you do not recognize, even if you owe nothing.

If you have Original Medicare, create or sign in to your account at medicare.gov/account/login. Medicare says the account lets you view your Original Medicare claims as soon as they are processed. Compare them with your calendar. If something looks wrong, Medicare’s fraud reporting page says to call 1-800-MEDICARE. If you have a Medicare Advantage Plan or a Medicare drug plan, you can also call the I-MEDIC investigations contractor at 1-877-7SAFERX (1-877-772-3379).

What success looks like: every claim since the breach date matches care you actually received, or you have reported each one that does not.

Step 4: Request copies of your medical and billing records

HIPAA gives you the right to see and get copies of your medical and billing records from covered providers and health plans. HHS says your provider normally has up to 30 days to respond, can charge only a reasonable fee, cannot charge per page if your records are stored electronically and cannot deny you a copy because you have an unpaid bill.

Start with the patient portal, which often lets you download records immediately. If you need more, send a written request to the provider’s medical records or privacy office and keep a copy. If you suspect a thief used your identity, the FTC advises asking every provider, pharmacy and lab where your information may have been used.

What success looks like: you have your current records and can check them for allergies, diagnoses, prescriptions or visits that are not yours.

Step 5: Ask who your records were shared with

You can also ask each provider or plan for an accounting of disclosures under 45 CFR 164.528. It lists certain disclosures of your health information over the past six years, including the date, who received it and why. The first request in any 12 month period is free, and the organization must respond within 60 days, with one possible 30 day extension. It does not cover routine treatment, payment and operations sharing, so treat it as one more clue rather than a complete log.

What success looks like: a written accounting from each organization named in the breach notice, with nothing unexpected on it.

Step 6: Correct anything that is wrong in your file

If a thief’s visits, diagnoses or prescriptions show up in your records, send a written amendment request to the provider or plan that created the entry. Identify each incorrect item, explain why it is wrong and attach supporting documents, such as your FTC identity theft report from Step 8. Under 45 CFR 164.526, the organization must act within 60 days, with one possible 30 day extension. If it refuses, it must explain why in writing, and you have the right to file a statement of disagreement that stays attached to your record.

What success looks like: written confirmation that the false entries were corrected, or a statement of disagreement on file.

Step 7: Protect your credit if your SSN or ID was exposed

Many health breaches also include Social Security numbers, birth dates and addresses. If yours did, place a free credit freeze at all three bureaus:

Equifax: Equifax.com/personal/credit-report-services, 1-800-685-1111
Experian: Experian.com/help, 1-888-397-3742
TransUnion: TransUnion.com/credit-help, 1-888-909-8872

Then pull your reports at AnnualCreditReport.com, which you can check online every week for free. Look for medical collections or accounts you do not recognize. Our guides on freezing your credit and what to do if your Social Security number was exposed cover this in full.

What success looks like: freezes confirmed at all three bureaus and no unfamiliar accounts or collections on your reports.

Step 8: Report misuse to the right agency

If you find claims, bills or records that are not yours, report it at IdentityTheft.gov. The site builds an identity theft report and a recovery plan you can send to insurers, providers and credit bureaus. For scams that use the breach as bait, report them at ReportFraud.ftc.gov.

If a provider or plan refuses to give you your records, ignores an amendment request or you believe it violated HIPAA, you can file a complaint with the HHS Office for Civil Rights through the OCR Complaint Portal. HHS says OCR generally acts only on complaints filed within 180 days of the violation, so do not wait.

What success looks like: an IdentityTheft.gov report number if your data was misused, and an OCR complaint confirmation if an organization denied your rights.

Common mistakes

Ignoring statements that say “this is not a bill”. Explanation of Benefits forms are where fake claims show up first.
Calling numbers from follow-up emails or texts. Scammers send fake breach follow-ups. Read our guide on checking a suspicious email safely.
Assuming HIPAA covers everyone. HHS notes that life insurers, employers, workers compensation carriers and most schools do not have to follow HIPAA, so your rights may differ with them.
Only checking once. Medical fraud can surface months later. Keep reviewing claims for at least a year.
Getting care with a record you have not checked. A thief’s allergies or blood type in your file can affect treatment, so review records before planned care when you can.