Health Prime International has told the public that sensitive patient information tied to some of its healthcare clients may have been exposed, and that notice letters will follow by mail.
Here is what the company has disclosed so far and what you can do if you think you are affected.
Health Prime International’s Data Breach Investigation
Health Prime International (HPI) is a revenue cycle management and analytics company that serves healthcare organizations. In a notice posted to its website, the company says it learned on or around August 3, 2026 that an unknown actor claimed to have accessed and acquired sensitive information related to patients of certain HPI clients.
According to that notice, the information was held by Tebra Technologies, a third-party healthcare software company that HPI uses to help its clients build their digital presence and modernize care. In other words, the data at issue was not described as sitting only on HPI’s own systems. It was kept with a vendor that supports HPI’s clients, which means the patients involved may never have heard of either HPI or Tebra before now.
The company says its investigation into the scope and nature of the incident is ongoing. It has not published the number of people affected, and this page does not estimate one. It has also not said which of its clients’ patients are involved, how the unknown actor got in, or whether the information has been published anywhere. Those are the details that usually shape how serious an incident is, and they are not yet part of the public record.
The notice also says that people whose information may have been exposed will receive a letter by mail once the investigation and review of the affected data are complete. That sequence matters. A person can be affected and still not have a letter in hand, because the company must first work out whose information was in the files and what each person’s record contained. If you have been a patient of a provider that outsources billing, analytics or digital services, you may be one of the people who hears about this later rather than sooner.
The wording of the notice is also worth reading closely. The company says an unknown actor claimed access, and that the information potentially exposed varies by individual. A claim by an outside party is not the same as a confirmed finding, and the notice does not say the company has verified every part of the claim. At the same time, the company did decide the matter was serious enough to announce publicly and to promise individual letters, which suggests it takes the possibility of exposure seriously.
This is not the first time the company has appeared in the breach record. ALN Medical Management, a company that became part of Health Prime International, disclosed an earlier and unrelated incident involving a third-party hosted environment, with access between March 18, 2024 and March 24, 2024. That earlier incident is a separate event with its own facts, and nothing in this page’s information links the two. It is mentioned only so readers can tell the two matters apart if they have received more than one notice.
Incidents that involve a vendor in the middle of a healthcare supply chain tend to affect many separate organizations at once. A billing or analytics company may work with dozens of practices, each with its own patients, and a software vendor may host records for several of those practices. When something goes wrong at one link, the notices can arrive from several different names, which is confusing for patients. Receiving a letter from a company you do not recognize does not mean the letter is a scam, but it is wise to confirm it through the contact details that the letter itself lists, or through your provider, rather than through a link in an unexpected message.
Medical and insurance details deserve particular care. Unlike a credit card number, which can be cancelled and replaced, a Social Security number, a date of birth and a health insurance identifier stay with a person for years. Taken together with a name and address, they can be used to open accounts, file false tax returns or submit fraudulent insurance claims. Medical information can add a further layer of risk, because it can be used to make a phishing message look believable to someone who has recently had treatment. That is why the steps listed further down this page are worth taking even if you have not yet received a letter.
Because the investigation is still open, the facts may change. The company may revise the number of people affected, the list of data types or the list of clients whose patients are involved. This page reflects only what was available in public sources at the time it was written, and it will not guess at anything beyond that. If you believe you are affected, keep any letter you receive, note the date it arrived, and keep a record of anything unusual that happens on your accounts afterward.
When Did This Breach Occur?
The company says it learned on or around August 3, 2026 that an unknown actor claimed to have accessed and acquired sensitive information related to patients of certain clients.
The date of the underlying access, and the date notice letters will be mailed, have not been published. The company says letters will go out by mail once its investigation and review of the affected data are complete.
What Information Was Breached?
According to the company, the information potentially exposed varies by individual and includes names, addresses, Social Security numbers, dates of birth, medical information and health insurance information.
Not every person will have every category exposed. Your own notice letter, once you receive it, is the best guide to what applies to you.
What You Can Do
If you think you may be affected by this incident, consider these steps:
- Watch your mail for a notice letter, keep it, and note the date it arrives.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review your bank, card and insurance statements, and your explanation of benefits forms, for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Health Prime International
If your personal information was exposed in this incident, you may have legal options. Companies are expected to protect the information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
