Mass General Brigham Medical Group (MGBMG), a member of the Mass General Brigham healthcare system, recently notified a patient of an incident involving their protected health information after a document was inadvertently sent to the wrong recipient through the organization’s secure patient portal.
Healthcare providers that handle protected health information have a responsibility to ensure it reaches only the intended recipient, and even a single misdirected document can expose sensitive personal and medical details that patients never intended to share.
Massachusetts General Brigham Medical Group’s Data Breach Investigation
According to a notification letter dated September 9, 2026, the Mass General Brigham Privacy Office became aware on September 1, 2026, that on or about August 26, 2026, a member of the MGBMG workforce inadvertently sent a document containing a patient’s protected health information to the incorrect patient through the organization’s secure patient portal. The letter states that the patient who mistakenly received the document identified the error and notified the sender, who then contacted the organization’s Chart Corrections team to have the document removed.
MGBMG describes the incident as an inadvertent workforce disclosure rather than a hacking or ransomware event, meaning there is no indication that an outside attacker breached the organization’s network or systems. Instead, the exposure resulted from a document being routed to the wrong patient account within the secure portal, a type of human-error incident that remains one of the most common causes of healthcare data breaches nationwide, even at large, well-resourced health systems with sophisticated security programs.
The notification letter identifies the information involved as the patient’s name, date of birth, driver’s license number, Social Security number, address, email address, and telephone number. That combination of identifiers, particularly a Social Security number paired with a driver’s license number and full contact information, is more than sufficient for a bad actor to attempt identity theft or fraudulent account openings if it were to fall into the wrong hands, even though in this case the document was sent to another patient rather than an unrelated third party.
Because the recipient of the misdirected document was another patient within the same healthcare system rather than an anonymous member of the public, MGBMG’s swift identification and removal of the document may reduce the practical risk of misuse compared to a broader external breach. However, the notification letter does not eliminate the possibility that the recipient retained a copy of the document, whether intentionally or inadvertently, before it was removed, which is why the organization is still offering credit monitoring services to the affected patient out of caution.
Workforce-error incidents like this one are a reminder that data breach risk is not limited to sophisticated cyberattacks. Simple mistakes, such as selecting the wrong recipient in an electronic health records or patient portal system, can expose the same categories of sensitive information that a hacking incident might, and the resulting risk to the affected patient’s identity and financial security is functionally the same regardless of how the exposure occurred.
MGBMG states that it has taken steps to prevent similar incidents going forward, including continuing to strengthen safeguards and promote training, education, and accountability across its workforce. The organization has also offered the affected patient 24 months of complimentary credit monitoring through Experian’s IdentityWorks service as a precaution.
The nature of this exposure also illustrates why breach notification laws apply regardless of intent. Massachusetts data breach notification requirements, like similar laws in most states, do not distinguish between information exposed through a malicious hacking incident and information exposed through an employee’s honest mistake. Both scenarios put a patient’s Social Security number, driver’s license number, and contact information into the hands of someone who was never supposed to see them, and both trigger the same notification and monitoring obligations under the law.
Affected patients should also be aware that Social Security number exposure carries risk that can persist for years after an incident, unlike a stolen credit card number, which can simply be canceled and replaced. A Social Security number cannot be changed in the same way, so ongoing vigilance, including periodic credit report reviews well beyond the 24-month monitoring window MGBMG is providing, is a reasonable precaution for anyone whose SSN was involved in an incident like this one.
When Did This Breach Occur?
The notification letter states that the misdirected document was sent on or about August 26, 2026, and that the MGBMG Privacy Office became aware of the incident on September 1, 2026. The notification letter to the affected patient is dated September 9, 2026, meaning the organization notified the affected individual within roughly two weeks of discovering the error.
What Information Was Breached?
According to the notification letter, the information involved included the patient’s name, date of birth, driver’s license number, Social Security number, address, email address, and telephone number.
What You Can Do
MGBMG is offering the affected patient 24 months of complimentary credit monitoring and identity protection services through Experian’s IdentityWorks program. The organization also recommends the following precautionary steps:
- Activate the complimentary Experian IdentityWorks credit monitoring described in your notification letter
- Consider placing a security freeze or fraud alert on your credit file with the three major credit bureaus
- Request a free copy of your credit report at annualcreditreport.com and review it for unfamiliar activity
- Review any police report rights available to you as a Massachusetts resident under state law
- Contact the Mass General Brigham Privacy Office with questions about the incident
File a Data Breach Lawsuit Against Massachusetts General Brigham Medical Group
If you received a notification letter from Mass General Brigham Medical Group about this incident, you may have legal options available to you. Healthcare organizations are entrusted with sensitive personal and medical information, and even an inadvertent internal disclosure can expose patients to real risks of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
