Healthcare Provider Email and Network Intrusions Expose Patient Data

General Physician, P.C. agreed to pay $2.5 million to settle consolidated class-action litigation tied to a 2024 email-environment compromise that exposed sensitive patient data. The organization detected suspicious activity on June 12, 2024, and a forensic investigation found an unauthorized party had accessed its email system from April 6 to June 12, 2024. Potentially exposed data included SSNs, financial account information, dates of birth, medical and treatment details, diagnoses, medical record numbers, and insurance information; the affected population was later updated to 167,387 individuals (after an initial placeholder report of 501 to HHS OCR). The settlement fund is intended to provide class benefits after fees/expenses, and the company did not admit wrongdoing.

Two additional California healthcare providers reported separate security incidents involving unauthorized access to systems containing patient information. Valley Radiology Consultants Medical Group identified a breach on September 15, 2025, engaged third-party incident response support, confirmed unauthorized access to its network and files, and began mailing notifications after completing file review on February 18, 2026; it also offered 12 months of credit monitoring and reported taking remediation steps (e.g., password changes and security enhancements). Nephrology Associates Medical Group separately began notifying patients about a cyberattack first identified on May 20, 2025 (details in the provided excerpt are truncated), indicating another healthcare-sector intrusion with patient data exposure risk.