Doctor’s Choice Home Care & Hospice, a Houston, Texas-based provider of home health and hospice services, has notified patients that an unauthorized party gained access to a clinical user account within a third-party electronic medical record system, potentially exposing their personal and clinical information.
Home health and hospice providers manage some of the most sensitive information a patient can have, detailed treatment plans, scheduling records, and identifying information, and they have a responsibility to secure that data whether it lives on their own servers or within a third-party platform they rely on for daily operations.
Doctor’s Choice Home Care & Hospice’s Data Breach Investigation
According to Doctor’s Choice’s public notification, between June 5, 2026, and July 24, 2026, an unauthorized party gained access to a single clinical user account within the WellSky electronic medical record system using compromised credentials. The company states it discovered the incident on July 21, 2026, and immediately began investigating alongside WellSky. Doctor’s Choice reports that its Chief Technology Officer confirmed the affected account was the only point of unauthorized access, and that a review of the company’s own internal systems found no related unauthorized activity beyond the single compromised WellSky account.
Doctor’s Choice states the exposed information may have included patients’ names, addresses, dates of birth, Social Security numbers, scheduling information, and clinical or treatment information. The company reports it disabled the affected account upon learning of the incident and is working with WellSky to strengthen the security controls around the platform to help prevent a recurrence.
This incident illustrates a broader pattern in the home health and hospice industry, where providers commonly rely on third-party electronic medical record and scheduling platforms rather than building and maintaining these systems internally. When an unauthorized party compromises credentials tied to a single user account within a shared platform like WellSky, the resulting exposure can affect patient records that were entered or accessed through that account over an extended period, in this case, nearly seven weeks, even when the healthcare provider’s own internal network was never directly breached.
Credential-based intrusions, where an attacker gains access using a legitimate but compromised username and password rather than exploiting a technical vulnerability, have become an increasingly common attack method across healthcare and other industries. These intrusions can be harder to detect quickly because the access, on its face, looks like ordinary account activity rather than an obvious system breach, which is part of why nearly seven weeks passed between the reported start of unauthorized access and the company’s discovery of the incident.
Because home health and hospice patients are often receiving ongoing care and rely heavily on continuity of services, they may be less likely than the general public to immediately scrutinize communications referencing their care, making them a particularly vulnerable population for follow-up phishing attempts that reference details from a genuine breach to appear more credible.
The combination of Social Security numbers with clinical and treatment information exposed in this incident carries particular risk. Beyond the standard concerns around credit fraud, medical identity theft, using a stolen identity to obtain prescription medications, medical equipment, or services under someone else’s name, can be difficult for a victim to detect until they receive a bill for care they never received or discover inaccurate information in their own medical records. For home health and hospice patients in particular, whose care often already involves multiple providers, insurers, and family caregivers coordinating on their behalf, untangling fraudulent activity tied to a breach like this one can be especially burdensome.
Doctor’s Choice has stated it is working directly with WellSky to strengthen the security controls surrounding the platform, which suggests the company views this as a vendor-side vulnerability rather than a failure specific to its own internal systems. That distinction does not change the practical impact on affected patients, whose personal and clinical information was accessible to an unauthorized party regardless of which party’s system the compromised credentials belonged to.
Patients working with home health and hospice agencies typically do not choose, and often are not even aware of, which back-office software vendors their provider uses to store and manage their medical records. This incident is a reminder that the security of a patient’s most sensitive health information can depend on decisions made well outside the patient’s own visibility, reinforcing why regulators and courts increasingly expect healthcare providers to vet and monitor the security practices of the third-party vendors and platforms they rely on, not just their own internal systems.
When Did This Breach Occur?
The unauthorized access occurred between June 5, 2026, and July 24, 2026. Doctor’s Choice states it discovered the incident on July 21, 2026, and disabled the affected account immediately thereafter.
What Information Was Breached?
Names, addresses, dates of birth, Social Security numbers, scheduling information, and clinical or treatment information were potentially exposed.
What You Can Do
If you received a breach notification letter from Doctor’s Choice Home Care & Hospice, consider taking the following steps:
- Monitor your credit reports and any free credit monitoring service offered in the notification letter
- Place a fraud alert or credit freeze with the three major credit bureaus
- Watch for unexpected medical bills, insurance statements, or unfamiliar prescriptions
- Report any suspected identity theft to the FTC at identitytheft.gov
File a Data Breach Lawsuit Against Doctor’s Choice Home Care & Hospice
If your personal or health information was exposed in this data security incident, you may have legal options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
