Mountain Rheumatology Data Breach: What Patients Need to Know

According to the U.S. Department of Health and Human Services Office for Civil Rights breach portal, Mountain Rheumatology Professional, LLC, a healthcare provider in Colorado, submitted a breach report on August 14, 2026. The portal categorizes the incident as a hacking/IT incident and lists the location of the breached information as a network server.

Federal law requires HIPAA-covered entities to report breaches of unsecured protected health information affecting 500 or more individuals, and the portal indicates the Mountain Rheumatology incident is among those currently under investigation. Beyond the portal listing, the practice has not published detailed public information about how the incident occurred, so the specifics reported at this stage are limited and may be supplemented as notifications are issued.

Because the incident was reported to the Office for Civil Rights as a HIPAA breach, it is understood to involve protected health information. However, the specific categories of data involved — such as names, dates of birth, Social Security numbers, diagnosis or treatment details, or insurance information — have not been publicly itemized as of the portal listing.

Rheumatology practices typically maintain sensitive medical records, including diagnoses, treatment plans, prescriptions, lab results, and insurance details, so patients may wish to treat the situation with appropriate caution until more is known. Where health-related information may have been exposed, there can be an increased risk of medical identity theft, fraud, or targeted phishing — even when a provider has not reported any known misuse.

Mountain Rheumatology Professional, LLC is a medical group based in Denver, Colorado, that diagnoses and treats conditions affecting the joints, muscles, bones, and tendons. The individuals potentially affected are likely to be current and former patients whose records were maintained on the affected systems, though the practice has not published a breakdown.

The HHS Office for Civil Rights portal lists 5,378 individuals as affected. Patients whose information was involved would generally receive a written notification from the practice describing the specific information at issue and any resources being offered. If you are a current or former patient and receive such a letter, it may indicate your information was among the data reported to have been affected.

Beyond the federal breach report, Mountain Rheumatology has not published a detailed public statement describing its response, and no notice about the incident was located on the practice’s website as of this writing. Providers responding to incidents of this kind commonly engage cybersecurity specialists, notify law enforcement, and review their security controls, but the practice has not publicly confirmed which steps it has taken.

If the practice is offering complimentary credit monitoring or identity protection services, those details would typically appear in individual notification letters. Affected patients may want to review any letter they receive carefully and follow its instructions for enrolling in any services offered before the stated deadline.

While the details of the Mountain Rheumatology incident are still emerging, affected patients may wish to consider a few precautionary steps:

• Watch for a notification letter. It may describe the specific information involved and any services being offered.
• Review your Explanation of Benefits statements. Watch for medical claims or services you did not receive, which can be a sign of medical identity theft.
• Check your credit reports. You are entitled to free annual credit reports at annualcreditreport.com, and you can watch for accounts or inquiries you do not recognize.
• Consider a fraud alert or credit freeze. These are available at no cost through Equifax, Experian, and TransUnion and can add a layer of protection.
• Stay alert to phishing. Be cautious of unexpected emails, calls, or texts referencing the incident, and verify communications through official channels before sharing information.

This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.

If your health information or personal data may have been involved in the Mountain Rheumatology data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.

Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.