Tebra Technologies, Inc. operates a cloud-based platform used by independent healthcare practices and medical billing companies. A data breach tied to patient information held on that platform has now been disclosed by one of its customers.
Here is what has been made public so far, what remains unknown, and what you can do if you may be affected.
Tebra’s Data Breach Investigation
Tebra Technologies, Inc. runs a cloud-based healthcare platform that brings together electronic health records, billing and patient experience tools for independent practices and medical billing companies. Its features include charting, telehealth, e-prescribing, automated claims processing and patient engagement.
The incident became public through a customer rather than through a notice written by Tebra. Health Prime International, a healthcare revenue cycle management company, posted a notice on its own website on September 29, 2026. That notice says Health Prime International learned on or about August 3, 2026 that an unknown actor claimed to have accessed and acquired protected health information relating to certain patients, and that the data was held on Tebra’s platform.
According to the same notice, Health Prime International began an investigation with the help of third-party forensic specialists to confirm the security of its systems and determine the nature and scope of the incident. At the time of the notice, that investigation was still ongoing and the review of the affected data had not been completed.
Several important facts are not yet public. The sources reviewed for this page do not say how the unknown actor gained access, how long the access lasted, how many people are affected in total, or which other Tebra customers, if any, are involved. They also describe the actor’s access as a claim, not as something confirmed. As of the sources reviewed, Tebra had not published its own statement about the incident, so this page does not attribute any cause or finding to Tebra.
Because the information was held on a vendor’s platform, people who received care from a practice or billing company that uses a third-party health technology provider may be notified by that practice or company, not by the technology provider itself. If you receive a letter that mentions Tebra or Health Prime International, keep it, since it is the most reliable source of detail about your own information.
Healthcare technology vendors are a common target for attackers because a single platform can hold records for many separate practices. Records that combine identity details with medical and insurance information are especially valuable, since they can be used for medical identity theft, fraudulent insurance claims and targeted phishing. This is general context about the sector and is not a statement about what happened in this specific incident.
State and federal breach notification laws generally require organizations to tell affected people, and often regulators, once a breach involving personal information is confirmed. Notices tend to be filed in stages, and the details can change as an investigation moves forward. If more facts are published about this incident, they may change the picture described here.
Until more is known, the safest approach is to assume that the types of information listed in the Health Prime International notice could be involved if you were a patient of a practice connected to it, and to take protective steps early rather than waiting for a second notice.
When Did This Breach Occur?
Health Prime International says it learned on or about August 3, 2026 that an unknown actor claimed to have accessed and acquired patient information.
It posted its website notice about the incident on September 29, 2026. The sources reviewed do not say when the unauthorized access itself took place.
What Information Was Breached?
The Health Prime International notice says the information that may have been exposed includes full name, address, Social Security number, date of birth, medical information and health insurance information.
The review of the affected data was not complete when the notice was posted, so the final list of data types may change. Your own letter, if you receive one, should describe what applies to you.
What You Can Do
If you received a notice related to Tebra or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you were a patient of a practice that uses Tebra or works with Health Prime International, watch for a notice from that practice or company.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Tebra
If your personal or health information was exposed in this incident, you may have legal options. Organizations that hold sensitive patient data are expected to protect it, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
