Included Health Inc. data breach exposes sensitive patient information

Included Health, Inc. reported a data breach on February 13, 2025, exposing sensitive patient information, including names and medical records.

What happened

On February 13, 2025, Included Health, Inc. filed a notice of data breach with the Attorney General of Massachusetts after discovering that an unauthorized party had accessed confidential information provided to the company. According to the notice, the breach allowed unauthorized access to consumers’ sensitive data, including names and medical record information. Following an internal investigation, Included Health began notifying affected individuals through official data breach letters. 

Going deeper

The exact cause of the breach remains unclear, as Included Health’s filing provided limited details on how the incident occurred. Regardless of the origin, Included Health has since completed its review of compromised files and identified which individuals were affected.

Notification letters sent to impacted individuals outline the nature of the breach and specify what personal information was compromised. 

Why it matters

The exposure of sensitive medical data can have severe consequences for affected individuals. With names and medical records compromised, victims may face risks such as medical identity theft, where fraudulent claims or prescriptions could be made in their name. Additionally, leaked medical history could lead to privacy violations, employment discrimination, or even targeted scams exploiting personal health conditions.

See also: HIPAA Compliant Email: The Definitive Guide

FAQS

What is a data breach?

A data breach occurs when unauthorized individuals gain access to sensitive, confidential, or protected information, potentially leading to identity theft, fraud, or other security risks.

What kind of information is typically affected in a data breach?

Depending on the nature of the breach, affected data may include personal details such as names, addresses, financial information, Social Security numbers, medical records, or login credentials.

How can I protect myself after a data breach?

If you believe your information has been compromised, consider monitoring your financial accounts, changing passwords, placing fraud alerts on your credit reports, and being cautious of phishing attempts.