Ritchie County Primary Care Association, which does business as Integrated Health Centers of West Virginia, has reported a data breach to the Vermont Attorney General’s office. The listing shows that Social Security numbers and health records were involved. This page summarizes what the public record says and will be updated if more information is released.
Integrated Health Centers of West Virginia’s Data Breach Investigation
Integrated Health Centers of West Virginia is the public name of Ritchie County Primary Care Association, a federally qualified health center with its administrative office in Harrisville, West Virginia. The organization provides medical, dental and behavioral health care at campuses in Doddridge, Pleasants, Ritchie and Wood counties, including several school-based clinics that are also open to families and the wider community. A community health center of this kind holds full patient charts, insurance and billing details, and the identifying information needed to coordinate care.
On October 23, 2026, the organization appeared in the Vermont Attorney General’s public listing of security breach notices, under its legal name and its trade name. The entry is classified as health care, reports 3 Vermont residents affected, and names two categories of information: Social Security numbers and health records. Vermont’s page notes that the number of residents affected may go up as companies determine the total number of impacted residents.
The Vermont listing is a summary, not a copy of the organization’s notice. It does not explain how the incident happened, when it began, when it was discovered, or how many people in other states may be affected. A search of public sources did not turn up a notice letter, a press statement from the organization, or an announcement of free credit monitoring at the time of this writing, so those details remain unconfirmed.
Three Vermont residents should not be read as the size of the incident. A health center based in West Virginia would be expected to serve mostly local patients, so notices reaching people in another state may point to a wider set of affected records, such as former patients who moved, or employees and other individuals. Regulators in each state generally receive only the count of residents who live there, and the total number of people whose information was involved has not been published.
The combination of a Social Security number and health records deserves attention. A Social Security number can be used to open credit accounts, apply for loans, file false tax returns or impersonate someone, while health records can be used for medical identity theft, in which a thief obtains care or files insurance claims in a victim’s name, as well as for targeted phishing. Unlike a password, neither can be easily replaced, so the risk from an exposure may last for years even when no misuse is seen right away.
State breach notification laws generally require an organization to tell affected individuals, and often the attorney general, once it determines that personal information was acquired without authorization. Health care organizations also answer to federal privacy rules. Notices are sent state by state, so a person may learn of an incident after a regulator’s public listing has already appeared, and the letter may arrive in a plain envelope that is easy to mistake for routine mail.
Because the public record is so limited, the most useful step for anyone who has received care from the organization is to watch for mail or email from it. A genuine notice will describe what happened and explain how to enroll in any protection services, and it will not ask you to send your Social Security number in reply. Keep any letter you receive, because it may include enrollment codes and deadlines.
It is also wise to be cautious about unsolicited messages that mention the incident. After a breach becomes public, scammers sometimes pose as the affected provider, an insurer or a government agency and ask people to confirm personal details or pay a fee. If you are unsure whether a message is real, contact the organization using a phone number or website you already know to be correct.
Attorneys are looking into whether Integrated Health Centers of West Virginia maintained reasonable safeguards for the sensitive information it held, including how it stored Social Security numbers and patient records, how it limited and monitored access to its systems, and whether stronger protections could have prevented or reduced the exposure.
When Did This Breach Occur?
The Vermont Attorney General’s listing shows that the organization’s notice was reported on October 23, 2026. Integrated Health Centers of West Virginia has not publicly stated when unauthorized access began or ended, or when it first discovered the incident, in the sources available to us. Until the organization or a regulator provides those dates, the timing of the underlying event should be treated as unconfirmed.
What Information Was Breached?
The Vermont listing identifies two categories of information: Social Security numbers and health records. It does not say whether names, dates of birth, insurance details or other information were involved alongside them, and the organization has not publicly described the data in more detail. No total number of affected people has been published, and the listing counts 3 Vermont residents.
What You Can Do
If you received a notice related to Integrated Health Centers of West Virginia or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If the notice offers credit monitoring or identity protection, enroll before the deadline, and ask the health center what parts of your chart were involved.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Integrated Health Centers of West Virginia
If you are a patient of Integrated Health Centers of West Virginia, or you received a notice letter about this incident, you may have legal options for holding the organization accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
