Eastside Gynecology & Obstetrics, a women’s health practice serving the Grosse Pointe, Roseville, Macomb, and Rochester Hills areas of Michigan and a member of the Together Women’s Health network, has notified patients that their personal information may have been exposed in a data breach. The breach occurred not at Eastside Gynecology & Obstetrics itself, but at a third-party vendor the practice relies on to manage patient records, underscoring that a healthcare provider’s data security responsibilities extend to the outside companies entrusted with patient information.
Eastside Gynecology & Obstetrics’s Data Breach Investigation
According to a notice posted by the vendor, patient information connected to Eastside Gynecology & Obstetrics was involved in a security incident at Aesto Health, a Birmingham, Alabama-based healthcare data services provider that manages data archiving and exchange for healthcare organizations. The breach occurred on December 18, 2025, when the vendor’s network was accessed without authorization, with the unauthorized activity reportedly occurring over a period in early December 2025. Information exposed in the breach reportedly included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, and Social Security numbers. Affected individuals were notified by mail after the incident was reported by Aesto Health to its covered-entity clients, including Eastside Gynecology & Obstetrics.
Breaches originating at a shared third-party vendor are becoming an increasingly common way patient data ends up exposed, since healthcare providers routinely depend on outside companies for services such as records archiving, data migration between electronic health record systems, billing, and IT support. When a vendor serving many healthcare organizations is compromised, patients of several unrelated practices and hospitals can be affected simultaneously, even though those patients have no direct relationship with the vendor. This is one reason HIPAA requires healthcare providers to maintain business associate agreements governing how vendors safeguard the patient data they handle.
The scope of data reportedly involved here is notable. Social Security numbers combined with driver’s license numbers and financial account details give criminals significantly more material for identity theft or fraudulent account openings than any single data element alone, while exposed medical information alongside identifying details can also be misused for insurance fraud. Patients affected by a breach involving this range of data types are generally advised to take a broader set of precautions than they might for a breach limited to names and contact information.
Notification timelines following a vendor-caused breach can take longer to unfold than a single-company incident, since the vendor must first identify every downstream healthcare organization whose patients were affected before those organizations can notify their own patients in turn. This layered process is a routine part of how multi-client vendor breaches are handled, not evidence of an unreasonable delay.
When Did This Breach Occur?
The breach at Aesto Health occurred on December 18, 2025, with unauthorized access reportedly beginning in early December 2025. Affected Eastside Gynecology & Obstetrics patients were notified by mail once the incident was confirmed and disclosed.
What Information Was Breached?
According to the notice, information reportedly exposed included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, and Social Security numbers.
What You Can Do
If you received a notification letter connected to this breach, consider the following steps:
- Monitor your credit reports and financial accounts for suspicious activity
- Consider placing a fraud alert or credit freeze with all three major credit bureaus
- Be alert to phishing emails or calls referencing the breach or your medical care
- Change passwords on any potentially affected accounts and enable two-factor authentication where available
- Keep a copy of your data breach notification letter for your records
File a Data Breach Lawsuit Against Eastside Gynecology & Obstetrics
If you are a patient of Eastside Gynecology & Obstetrics and received a data breach notification letter, or believe your information may have been exposed in this incident, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
