Brown Health Medical Group-MA Data Breach: What Patients Need to Know

According to a substitute notice issued by Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA, the practice first became aware on December 16, 2025, of a data security incident affecting a historic file server at its Hawthorn location. The practice states that it immediately began an investigation and isolated the server, and that the investigation determined the unauthorized access occurred between December 15 and December 16, 2025. According to the notice, the incident did not impact the practice’s electronic health record system.

The practice reports that, because of the nature of the incident, it was unable to conclusively determine exactly what information was impacted, and that on June 22, 2026, it determined the scope of personal information that may have been involved. Notification letters and the public substitute notice followed on July 16, 2026, the same date the incident was reported to the U.S. Department of Health and Human Services. As with many incidents of this kind, details reported at this stage may be refined as the review continues.

In its notice, the practice states that the categories of information that may have been impacted include demographic information such as name, date of birth, and contact information; health insurance information; medical information; billing, claims, and payment information; and other personal information such as Social Security numbers, driver’s license numbers or other government-issued identification numbers, credit or debit card numbers, and financial account information.

For a subset of individuals, the practice reports the impacted information may also have included personnel and human resources records, such as compensation or payroll information, licensure or credentialing information, and medical or disability-related records, indicating that employees as well as patients may be affected. The notice emphasizes that not all categories of information were impacted for all individuals. Where identifiers such as Social Security numbers and payment card data may have been exposed alongside health information, there can be an elevated risk of identity theft, medical identity theft, and financial fraud.

The U.S. Department of Health and Human Services Office for Civil Rights breach portal lists 311,760 individuals as affected by the incident, categorized as a hacking/IT incident involving a network server and submitted on July 16, 2026. The Vermont Attorney General’s office lists 86 Vermont residents among those notified, and reporting on the practice’s filing with the Massachusetts Attorney General indicates roughly 290,000 Massachusetts residents were affected, though the practice itself has not published a state-by-state breakdown.

Brown Health Medical Group-MA is the Massachusetts physician-practice arm of Brown University Health, the system formerly known as Lifespan, and the notice ties the incident to its Hawthorn location. Individuals potentially affected may include current and former patients of the practice as well as employees whose personnel records were maintained on the affected server. If you received a letter from Lifespan Physician Group of Massachusetts or Brown Health Medical Group-MA referencing this incident, that notice may indicate your information was among the data reported to have been affected.

The practice reports that it isolated the affected server, investigated the incident, notified law enforcement, re-trained its employees, and implemented additional technical safeguards intended to prevent incidents of this nature from recurring. It states that it is providing complimentary identity restoration and fraud detection services to affected individuals for two years.

According to the notice, individuals with questions about the incident can call a dedicated line between 9:00 a.m. and 9:00 p.m. Eastern Time, Monday through Friday, excluding major holidays. If you received a notification letter, it should include instructions for enrolling in the offered services; reviewing that letter closely can help you take advantage of them before any stated deadline.

Given the breadth of information the practice reports may have been involved, affected individuals may wish to consider a few precautionary steps:

• Enroll in the offered services. If your letter includes enrollment instructions for the two-year identity restoration and fraud detection services, consider activating them.
• Consider a credit freeze or fraud alert. Both are free through Equifax, Experian, and TransUnion, and a freeze can help prevent new accounts from being opened with a stolen Social Security number.
• Review your payment cards and financial accounts. Because credit or debit card numbers and financial account information may have been involved, watch for unfamiliar charges and consider asking your bank about replacing affected cards.
• Monitor your Explanation of Benefits statements. Watch for medical claims or services you did not receive, which can be a sign of medical identity theft.
• Stay alert to phishing. Be cautious of unexpected emails, calls, or texts referencing the incident, and verify communications through official channels before sharing information.

This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.

If your health information or personal data may have been involved in the Lifespan Physician Group of Massachusetts / Brown Health Medical Group-MA data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.

Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.