Heart of America Medical Center, a critical access hospital serving more than 13,000 people in and around Rugby, North Dakota, recently notified current and former patients that a data security incident may have exposed some of their personal information. The hospital’s investigation into the incident, first detected in June 2025, took nearly a year to complete before notification letters were sent out.
Healthcare providers that maintain patient records have both a legal and ethical duty to protect that information from unauthorized access. When a breach occurs at a hospital or medical center, patients can be left facing not only the usual risks of identity theft, but also the possibility of medical identity theft affecting their own care.
Heart of America Medical Center’s Data Breach Investigation
According to a notification letter sent to affected individuals, Heart of America Medical Center became aware of suspicious activity within its network environment on or about June 12, 2025. The hospital says it immediately took steps to lock down and secure its systems, and engaged a specialized third-party cybersecurity firm along with IT personnel to investigate the scope of the incident. That forensic investigation concluded on September 15, 2025, and identified which files had been compromised. Heart of America provided substitute notice of the incident on its website on September 20, 2025, while the more detailed process of determining exactly which individuals were affected and what specific information was involved continued.
The hospital then engaged a third-party vendor to conduct an extensive data review process to identify potentially impacted individuals and the types of information that may have been involved, a process that did not conclude until May 12, 2026. After further internal review, Heart of America completed its assessment on June 9, 2026, and engaged a notification vendor on June 15, 2026, to begin the process of locating and verifying mailing addresses. The hospital finalized its list of individuals to notify on July 9, 2026, before organizing mailing, call center, and credit monitoring services for the affected population.
Healthcare organizations, particularly smaller critical access hospitals like Heart of America, are frequent targets of cyberattacks because they maintain large volumes of sensitive patient data, including medical records, insurance information, and Social Security numbers, while often operating with more limited cybersecurity budgets than large hospital systems. The lengthy timeline between initial detection in June 2025 and notification over a year later illustrates how complex a full forensic investigation and individual-notice process can become, particularly for a hospital serving a broad rural population across multiple counties.
Heart of America has stated that the specific personal information affected varies by individual, and the publicly available version of its notification letter does not list every category of data involved. Following the incident, the hospital says it implemented several security enhancements, including updates to its security technologies and vendors, expanded employee security awareness training, and completed internal and external security testing. It is offering 24 months of complimentary credit monitoring services through HaystackID to those affected.
Because compromised healthcare data can be misused for both traditional identity theft and medical identity theft, patients who receive a notification letter from Heart of America Medical Center should take the incident seriously and monitor both their financial accounts and their medical billing statements for signs of misuse.
When Did This Breach Occur?
Heart of America Medical Center first became aware of suspicious network activity on or about June 12, 2025. Its forensic investigation concluded on September 15, 2025, and the hospital completed its review of affected individuals and data types on June 9, 2026, before sending notification letters in the summer of 2026.
What Information Was Breached?
Heart of America Medical Center has stated that the personal information potentially subject to unauthorized access varies for each affected individual and has not published a single universal list of data categories involved. Given that the hospital serves as a healthcare provider, potentially affected information commonly includes patient names in combination with medical treatment information, health insurance details, and other identifiers such as Social Security numbers, though the hospital has not confirmed a specific list applicable to all recipients.
What You Can Do
If you received a notification letter from Heart of America Medical Center, consider taking the following steps to help protect yourself:
- Enroll in the complimentary Single Bureau Credit Monitoring services referenced in your letter within 90 days of the letter’s date.
- Review your medical bills and insurance statements (Explanation of Benefits forms) for any unfamiliar treatment or claims.
- Request a free copy of your credit report from each of the three major credit bureaus at annualcreditreport.com.
- Consider placing a fraud alert or credit freeze on your credit file with Equifax, Experian, and TransUnion.
- Report any signs of identity theft or medical identity theft to your local police department and the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Heart of America Medical Center
If you received a notice that your personal information may have been compromised in the Heart of America Medical Center data breach, you may have legal options available to you. Healthcare providers that collect sensitive patient information are expected to implement reasonable safeguards to protect it, and affected individuals may be entitled to compensation for the risks and burdens they now face.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
