MedCom Solutions has reported a data breach to a state regulator. This page explains what the public filing says, what has not been disclosed and what patients and others connected to the company’s healthcare clients can do now.
The details below come from a state attorney general listing and may change as the company releases more information.
MedCom Solutions, Inc.’s Data Breach Investigation
MedCom Solutions, Inc. is a Pittsburgh, Pennsylvania company that sells charge capture software and revenue cycle consulting to hospitals and physician practices. Its own website describes services such as chargemaster review, payment and denial analytics and system conversion work. Companies in this line of business work behind the scenes for healthcare providers, which means the people whose records they handle are usually patients who have never heard of them.
The breach became public through the Vermont Attorney General’s security breach notice listing. The entry for MedCom Solutions is dated November 13, 2026, the date the breach was reported to the attorney general’s office. The listing classifies the company as a Health Care organization and states that 2 Vermont residents were affected.
That count is small, and it should be read carefully. Vermont reports only its own residents, so the figure says nothing about how many people in other states may have been affected. Companies in this position often send notices to residents of several states, and they may file separate reports with other regulators, including the federal health privacy regulator. No nationwide total for MedCom Solutions has been published, and this page does not estimate one.
The listing names a single category of information: health records. It does not say which records were involved, which healthcare provider they came from, or whether they included diagnosis, treatment, billing or insurance details. It does not say whether the records were stored in the company’s own systems or in a client’s system the company was working in, and it does not say whether they were exposed in readable form.
Filings like this one are often the first public sign of an incident, and they tend to be updated or supplemented later. A company may learn more about the scope of an event after its initial report, and regulators in other states may post their own entries at different times. For that reason, it is sensible to check for updates over the coming weeks rather than treating the first listing as the final word on who was affected.
Equally important is what the filing leaves out. It does not describe how the incident happened, when it began, when it was discovered or whether an outside party obtained any data. It does not name the hospitals or practices whose patients may be involved. Until MedCom Solutions gives its own account of the incident, the cause and the full scope remain unknown.
Health records matter because of the range of harm they can enable. Beyond ordinary identity theft, medical identity theft occurs when someone uses another person’s identity to obtain care, prescriptions or insurance benefits. It can leave false entries in a medical file and unexpected bills or insurance claims in the victim’s name. Because these problems are often noticed late, reviewing explanation-of-benefits statements and medical bills is a practical safeguard.
Vendors that support hospitals and physician offices are frequent targets for cyberattacks because they hold information from many providers in one place and often connect to provider systems. That context describes the sector as a whole. It is not a statement about how this particular incident occurred, which the company has not explained.
State and federal rules require organizations to notify the people affected, and a company that acts for healthcare providers often sends notices on their behalf. If you receive a written notice that refers to MedCom Solutions, keep it, since it is the best record of what the company says was involved and what protection it is offering. If you think a hospital or practice you used may have worked with the company and you have not received a notice, you can begin the protective steps below while more details come out.
When Did This Breach Occur?
The listing gives November 13, 2026 as the date the breach was reported to the Vermont Attorney General. It does not provide the date the incident occurred, the date it was discovered or the date notices were sent to affected people. Those dates have not been made public. If the company or another regulator publishes a fuller notice, compare its timeline with the date on any notice you received.
What Information Was Breached?
According to the Vermont listing, the information involved was health records. The listing does not name any other category, and it does not explain what the records contained. Because the company has not published its own notice, it is not clear whether names, Social Security numbers, insurance information or other details were involved. Read any notice you receive closely to see which items apply to you.
What You Can Do
If you received a notice related to MedCom Solutions, Inc. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because health records are the category listed, review insurance statements and explanation-of-benefits forms for services you did not receive, and ask your providers for a copy of your records if something looks wrong.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against MedCom Solutions, Inc.
Attorneys are looking into the data breach reported by MedCom Solutions and want to hear from patients and others who received a notice or believe their information was exposed. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the company ultimately confirms about the incident. If you received a notice or believe your information was involved, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
