Health Payment Systems, Inc. (HPS), a Wisconsin-based business associate that operates the PayMedix healthcare payment platform, has disclosed a data security incident to the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR). The incident, classified as a hacking/IT event involving email, is estimated to affect approximately 9,380 individuals. As a business associate that processes payment and billing information on behalf of health plans and providers, HPS has a legal duty to protect the sensitive personal and financial data entrusted to its systems.
Health Payment Systems, Inc.’s Data Breach Investigation
According to the HHS OCR Breach Portal, which tracks incidents affecting 500 or more individuals, Health Payment Systems, Inc. reported this breach on July 10, 2026, describing it as a hacking/IT incident with the affected information located in email. The company has not yet released a detailed public notification letter explaining precisely how the unauthorized access occurred or what data elements were confirmed exposed.
Health Payment Systems operates as a high-performing, independent provider network and is the parent company to PayMedix, a healthcare expense-of-benefit and payment platform used by self-insured employers and health plans. Because HPS’s business model centers on processing claims data, payment records, and member eligibility information across many client organizations, a single compromised email account can potentially expose data belonging to individuals across numerous unrelated employer health plans, not just direct customers of HPS itself.
Email compromise remains one of the most frequently reported breach vectors in the healthcare and healthcare-payments sector, typically stemming from phishing campaigns, credential theft, or business email compromise schemes that specifically target finance and billing staff. Given the size of this reported incident, with nearly 9,400 individuals potentially affected, this appears to be a more significant event within the broader landscape of business-associate breaches reported to federal regulators in 2026.
Individuals whose payment or health-plan data passes through a processor like HPS often have no direct relationship with the company and may not immediately recognize its name on a breach notification. Following an incident like this, it is common for affected individuals to receive notice weeks after the initial regulatory filing, once the company’s investigation and the process of identifying affected records is complete. Given the financial nature of PayMedix’s services, exposed data in a breach like this can carry heightened risk for payment fraud and targeted phishing tied to real billing details, making early monitoring especially important even before a full account of the exposed data types becomes public.
When Did This Breach Occur?
Health Payment Systems, Inc. reported this incident to HHS OCR on July 10, 2026. The company has not publicly disclosed the specific date the underlying email compromise is believed to have occurred or when it was first internally discovered.
What Information Was Breached?
Health Payment Systems, Inc. has not publicly detailed the specific categories of personal or financial information involved in this incident. The HHS OCR filing identifies the location of the breached information only as email, affecting an estimated 9,380 individuals. Given that HPS processes healthcare payment and billing data, exposed information in incidents of this type can include personal identifiers and payment-related details, though the company has not confirmed a specific list publicly.
What You Can Do
If you believe you may have been affected by this incident, consider taking the following precautions:
- Review your health plan statements and payment records for unfamiliar activity
- Watch for phishing emails or calls referencing your health benefits or billing information
- Consider placing a fraud alert or credit freeze with the major credit bureaus
- Keep any notification letter you receive from Health Payment Systems, Inc. or PayMedix for your records
- Report any suspicious account activity to your bank or health plan immediately
File a Data Breach Lawsuit Against Health Payment Systems, Inc.
If your personal information was compromised in this breach, you may have legal options available to you. Companies that collect and store sensitive personal and financial information have a legal duty to protect it from unauthorized access.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
