Mountain Rheumatology Data Breach: 5,378 People on the Federal List

Mountain Rheumatology Professional, LLC filed a breach report with the U.S. Department of Health and Human Services on August 14, 2026. The HHS Office for Civil Rights lists it as a hacking or IT incident affecting a network server, and as of October 6, 2026, the report still appears among the cases HHS describes as currently under investigation.

The practice hasn’t said when the intrusion began, when it was found or how it happened, and we found no notice about it on the practice’s website.

Federal law routes breaches of unsecured protected health information involving 500 or more people to this HHS list, so the filing confirms health data was involved; what it doesn’t reveal is which kinds. The practice hasn’t published a list of data types, and none of the state breach lists we checked in California, Massachusetts, Texas and Vermont carries a filing that would.

Specialty practices keep detailed records, and a rheumatology chart can include diagnoses, lab results and medication history alongside insurance details. That’s reason enough for patients to watch for misuse until letters spell out what was involved.

Mountain Rheumatology describes itself on its website as a Denver rheumatology practice offering appointment booking and a patient portal. The federal listing shows 5,378 people affected but doesn’t say whether they’re current patients, former patients or others.

Under HIPAA, each person whose information was involved should receive written notice, generally within 60 days after the practice discovered the breach. Because the discovery date hasn’t been made public, the timing of those letters can’t be checked from public records.

Mountain Rheumatology hasn’t published a statement about its investigation, the security steps it has taken or whether it will offer credit monitoring. Those details usually arrive in individual notice letters, which should also name the information involved for each patient.

Not having a letter yet doesn’t necessarily mean your information was left out, so keep an eye on your mail.

• Look for a letter from the practice describing what was involved and any services offered.
• Compare insurance statements with your real appointments, lab work and prescriptions, and flag anything you didn’t receive.
• Change your patient portal password if you use the portal, as a general precaution.
• Consider a credit freeze, which costs nothing and can be lifted when you need credit.
• Be skeptical of calls about the breach, and verify any request using contact information you look up yourself.

This overview doesn’t replace legal advice; a legal professional can explain how it applies to you.

Are you a current or former Mountain Rheumatology patient concerned that your health information was on the hacked server? Wilshire Law Firm’s nationally recognized, award-winning team handles data privacy and health data breach claims, and incidents like this one are sometimes pursued as class action cases. You can speak with a legal professional in a free consultation or free case review at any hour, and there are no fees unless you get paid.

Reach out today to talk it through.