Dorsata, Inc. has notified patients of a data security incident involving Metabase, a third-party business intelligence software vendor, that may have affected protected health information. The company says Social Security numbers were not involved.
Dorsata, Inc.’s Data Breach Investigation
Dorsata, Inc., based in Charlottesville, Virginia, partners with women’s health clinics and physicians to provide workflow and decision-support technology that is used alongside a healthcare provider’s electronic health records system. Software of this kind sits close to patient charts, which means a security problem at the vendor can touch protected health information that patients originally shared only with their doctor.
According to the notice letter filed with the California Attorney General, Dorsata received a notice on August 12, 2026 that the Metabase business intelligence software it uses contained a security vulnerability. The company says it immediately patched the software and began an investigation with the help of third-party cybersecurity experts. Metabase is a separate vendor’s product, so the incident is described as arising from a third-party tool rather than from a flaw Dorsata built itself.
The investigation determined that the vulnerability allowed unauthorized access to Dorsata’s database platform from August 10, 2026 to August 12, 2026. Dorsata reviewed the data involved and advised the affected healthcare providers that their patients’ protected health information was contained within the affected data. The letter says those providers then asked Dorsata to notify patients, which is why the notice comes from a technology vendor rather than from a patient’s own clinic. Dorsata states that it has no evidence of misuse, or attempted misuse, of any potentially impacted information.
The filing does not give a total number of people affected, and no count appears in the letter. Because the notice is sent on behalf of multiple healthcare providers, the number could be larger than a single clinic’s patient list, but the filing does not say so and this page does not estimate one. If a total is published by Dorsata or a regulator, this page can be updated.
The letter on file with the state is a template, not a filled-in copy mailed to any one person. Its list of the specific kinds of information involved appears as an unfilled placeholder, so the filing does not tell the public which categories of data apply. The company does say that the information may have included a patient’s name and that Social Security numbers were not involved. Anything beyond that would be a guess, so this page makes none. The individual letter a patient receives is the best source for what was involved in that person’s case.
Healthcare technology vendors are a frequent target for attackers and a frequent source of exposure for another reason: they aggregate records from many practices in one database. That makes the security of every connected tool, including analytics and reporting software, important. When a single analytics component has a known vulnerability, the window between the flaw becoming public and the patch being applied can matter a great deal. In this case, Dorsata says it patched the software as soon as it was told about the problem. That is general industry context, not a statement about how any specific person’s information was handled.
Health information is among the most sensitive data a person has. Unlike a stolen card number, it cannot be replaced, and it can be used to craft convincing phishing messages that mention a real provider or condition, or to attempt medical identity fraud. Even without a Social Security number, details such as a name together with treatment information can be misused, and patients may reasonably want to watch for explanation-of-benefits statements or bills for services they did not receive.
Companies that hold patient information on behalf of healthcare providers are expected to protect it with reasonable safeguards and to notify people promptly when it may have been accessed without authorization. Whether the measures in place here met that expectation is not something the filed notice answers. Those are the kinds of questions attorneys can raise on behalf of patients who were harmed, and this page will be reviewed if more detail about the incident is published.
When Did This Breach Occur?
The notice says the vulnerability allowed unauthorized access to Dorsata’s database platform from August 10, 2026 to August 12, 2026. Dorsata received word of the vulnerability on August 12, 2026 and patched the software right away.
The copy of the letter filed with the California Attorney General is a template and its date line is an unfilled placeholder, so this page does not state a notification date. Patients who received a letter should check the date printed on their own copy.
What Information Was Breached?
The notice says the information may have included a patient’s name along with other protected health information. The specific list of data elements is an unfilled placeholder in the filed template, so it is not publicly known which categories apply to each person. Dorsata states that Social Security numbers were not involved.
Because the notice does not name every category, treat any health-related detail you shared with your provider as potentially involved until your own letter says otherwise.
What You Can Do
If you received a notice related to Dorsata, Inc. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Review explanation-of-benefits statements and bills from your insurer and providers for services you do not recognize, and ask your provider’s office which of your records were involved.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Dorsata, Inc.
If you received a notice from Dorsata or from your healthcare provider about this incident, you may have legal options. Companies are expected to safeguard the sensitive health information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
