Secure Healthcare Information Management, LLC has notified people that their personal and health information may have been involved in a data security incident. The company, which provides billing and medical management services to physicians in northeastern Pennsylvania, began mailing notices on October 6, 2026.
Secure Healthcare Information Management’s Data Breach Investigation
Secure Healthcare Information Management, LLC, known as SHIM, is a billing and medical management company based in Allentown, Pennsylvania. It serves independent physicians and medical institutions in the northeastern part of the state. Because a company like this handles billing and records on behalf of medical practices, it holds identifying details and health information for patients who may never have dealt with SHIM directly.
According to the public notice SHIM issued, the company experienced a network disruption on July 17, 2026, and opened an investigation with the help of outside cybersecurity experts. That investigation found that an unknown actor had accessed or acquired certain files without authorization at some point between July 6, 2026 and July 16, 2026. In other words, the intruder appears to have had access to the files for roughly ten days before the disruption brought the problem to light.
SHIM then reviewed the affected files to work out whether they contained personal information and whose information was involved. On September 18, 2026, the company confirmed the scope of the impact and gathered enough contact information to send notices. SHIM mailed those notices on October 6, 2026, to the people for whom it had identifiable address information. The company also said it reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights and to the consumer reporting agencies, and that it put additional measures in place intended to reduce the risk of a similar incident.
The notice does not say how many people were affected, and it does not name the medical practices whose patients are involved. It also does not say how the unknown actor got into SHIM’s systems, whether the files were encrypted, or whether any of the information has been published or sold. This page does not guess at any of those points. If SHIM or a regulator releases a total, the picture will become clearer.
The timeline here is a common one in data security incidents. The gap between the first sign of trouble on July 17, 2026 and the mailing of notices on October 6, 2026 reflects the time it takes to examine files one by one, match them to individuals, and find current addresses. For the people affected, that gap means personal information may have been in someone else’s hands for months before any letter arrived.
Billing and practice management companies are a recurring target for attackers because they sit between many medical offices and keep large volumes of patient records in one place. A single compromise at a vendor can reach the patients of every practice it supports. That is why people who see a notice from a company they do not recognize should not assume it is a mistake. If your doctor’s office uses an outside billing company, the notice may be from that company rather than from the office itself.
The combination of data SHIM listed is also significant. Names, dates of birth and Social Security numbers are the core material for identity theft, since together they can be used to open credit accounts, file false tax returns or pass identity checks. A driver’s license or state identification number adds another way to impersonate someone. Medical and health insurance information brings its own risk, which is medical identity theft, where someone uses a person’s coverage details to get care or submit false claims. Unlike a password, none of these identifiers can be changed easily, and the risk can last for years.
SHIM offered eligible people complimentary identity protection services through Cyberscout, a TransUnion company, and set up a call center for questions. People who did not get a notification letter but think they may be affected can ask the call center to verify their eligibility for those services. The enrollment deadline is January 4, 2027. Anyone who received a letter should read it closely for enrollment codes and instructions, and keep the letter and envelope in a safe place in case they are needed later.
Companies that collect Social Security numbers and medical information are expected to protect them with reasonable security measures. When an incident like this one comes to light, affected people often want to know how the intrusion happened, how long the data was exposed, and whether the safeguards in place were adequate. Those questions can be raised on behalf of affected people through a class action, which is one reason breach notices like this one draw legal attention.
When Did This Breach Occur?
SHIM says an unknown actor accessed or acquired files without authorization between July 6, 2026 and July 16, 2026. The company noticed a network disruption on July 17, 2026, and began investigating. It confirmed the scope of the impact on September 18, 2026, and mailed notices on October 6, 2026.
The notice does not say whether the attacker’s access continued beyond July 16, 2026, or when exactly the files were taken.
What Information Was Breached?
SHIM says the potentially affected information may have included names, dates of birth, Social Security numbers, driver’s license or state identification numbers, medical information, and health insurance information.
The notice uses the word “may,” and it does not say which items apply to which people. Your own notice letter is the best guide to what was involved in your case.
What You Can Do
If you received a notice from SHIM or think you may be affected, consider these steps:
- Read the notice carefully. Enroll in the complimentary Cyberscout identity protection services before the January 4, 2027 deadline if you are eligible.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review explanation-of-benefits statements, medical bills and financial accounts for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Secure Healthcare Information Management
If your personal or health information was exposed in this incident, you may have legal options. Companies that handle Social Security numbers and medical records are expected to safeguard them, and a class action can help hold a company accountable when it falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
