Medical Records & PHI Data Breaches

Medical records and protected health information (PHI) contain some of the most sensitive information a person can have. A healthcare organization may hold diagnoses, treatment histories, prescription information, insurance details, medical record numbers, Social Security numbers, and other personal information. When that information is exposed through a data breach or other security incident, the consequences can extend beyond ordinary identity theft to privacy concerns, medical identity theft, inaccurate records, and other potential harm.

Net Law Advocates represents individuals nationwide whose medical records, PHI, insurance information, or other sensitive healthcare data may have been exposed, accessed, or disclosed without authorization. Whether a healthcare data breach creates a viable legal claim depends on what information was involved, how the incident occurred, which organization or vendor possessed the information, the laws that apply, and whether the affected individual suffered legally recognized harm.

May Still Be Covered by Federal Law

The growth of health applications and connected technologies has created a substantial category of health information that may fall outside HIPAA.

The Federal Trade Commission’s Health Breach Notification Rule applies to certain vendors of personal health records, PHR-related entities, and third-party service providers that are not covered by HIPAA.

The FTC amended the rule in 2024 to clarify its application to health apps and similar technologies. The amended rule also makes clear that a covered “breach of security” can include unauthorized acquisition resulting from a data security incident or an unauthorized disclosure.

For covered breaches involving 500 or more individuals, notification to the FTC generally must occur at the same time notices are sent to affected individuals, which must be without unreasonable delay and no later than 60 calendar days after discovery.

This creates an important dividing line: traditional healthcare records may be governed by HIPAA, while some consumer health technologies may instead fall within the FTC’s health-breach framework. These distinctions are part of the broader legal issues addressed in our healthcare data breach resources.

State Laws Can Add Another Layer of Protection

Federal healthcare privacy rules do not eliminate state law.

Medical information may also fall within state data breach statutes, consumer privacy laws, medical confidentiality laws, or other legal protections.

State laws can define covered information differently and impose their own notification requirements.

They may also affect what private legal claims are available to someone whose medical information was exposed.

This means a breach should not be evaluated solely by asking whether HIPAA applies.

The relevant questions include what information was compromised, which organization held it, where affected individuals are located, what caused the exposure, and which federal and state laws govern the incident.

Does HIPAA Allow You to Sue Over Exposed Medical Records?

HIPAA itself does not provide a general private right of action allowing an individual to sue solely because a healthcare organization violated HIPAA.

HIPAA enforcement is handled federally by the HHS Office for Civil Rights.

That distinction is important because breach letters and lawsuits frequently reference healthcare information that is subject to HIPAA, but HIPAA is not necessarily the legal vehicle through which an affected patient brings a private claim.

Depending on the circumstances, state privacy laws, consumer protection statutes, negligence, contract theories, medical confidentiality laws, or other causes of action may be relevant.

Whether any of those theories applies depends on the jurisdiction and facts.

A HIPAA Breach Does Not Automatically Establish a Private Data Breach Claim

The concepts can overlap without being identical.

A HIPAA-regulated organization may have federal notification or security obligations after an incident.

A private plaintiff may separately need to establish the elements required under the law supporting the individual’s lawsuit.

Those elements can include questions of duty, causation, standing, injury, damages, statutory coverage, or other requirements depending on the claim.

As a result, a healthcare organization’s statement that PHI was involved does not automatically mean every affected person has a viable lawsuit.

The reverse is also important. The absence of a private HIPAA claim does not necessarily mean there is no potential remedy under another law.

What Should You Look for in a Medical Data Breach Notice?

Start with the description of the information involved.

Rather than focusing only on the size of the breach or name of the organization, determine whether the notice says your information may have included:

• Social Security numbers
• Medical record numbers
• Diagnoses or conditions
• Treatment information
• Prescription information
• Health insurance details
• Claims information
• Financial information
• Account credentials

Next, look at the incident timeline.

The letter may distinguish among the date unauthorized access began, when suspicious activity was detected, when the organization determined personal information was involved, and when notification was issued.

Also note whether another company was involved.

An outside billing, technology, or administrative provider may be central to understanding where the records were actually compromised.

What Records Should You Preserve After a PHI Breach?

The original breach notice should be retained.

Other useful documentation can depend on what happens after the incident.

Consider preserving:

• Emails or notices concerning the breach
• Envelopes showing when written notices were mailed
• Credit-monitoring enrollment information
• Medical bills you do not recognize
• Explanations of benefits showing unfamiliar claims
• Communications with your health insurer
• Patient portal screenshots showing suspicious activity
• Credit reports reflecting unfamiliar accounts
• Identity-theft reports
• Receipts for costs incurred responding to misuse
• Correspondence disputing fraudulent activity

Someone who believes inaccurate information has entered a medical record may also want to document communications with the healthcare provider concerning those records.

The goal is to preserve what happened after the breach rather than assuming evidence can be reconstructed later.

What If Your Medical Information Was Accessed but Not Published?

Medical information does not need to appear publicly on the internet for an exposure to matter.

A breach can involve unauthorized access, acquisition, use, or disclosure without public publication.

For example, an attacker might download a database without posting the records online. An employee could access a medical record without authorization. Sensitive information might be sent to an unintended recipient.

The absence of public disclosure can affect the factual and legal analysis, but it does not by itself mean no breach occurred.

Likewise, a notice that information was potentially accessible does not necessarily prove that an unauthorized person actually viewed or acquired every record.

The available forensic evidence matters.

Can You Sue After a Medical Records or PHI Data Breach?

Potentially.

Whether a legal claim exists depends on the circumstances rather than simply on whether PHI appeared in a breach notice.

Relevant considerations can include:

• What medical and personal information was involved
• Whether the information was accessed, acquired, disclosed, or merely potentially available
• How the breach occurred
• Whether the information was encrypted or otherwise secured
• Whether the organization was subject to HIPAA
• Whether a business associate or other third party was involved
• Which state laws apply
• Whether medical identity theft or other misuse occurred
• Whether the affected individual suffered a legally recognized injury
• What private causes of action and remedies are available

A breach involving detailed medical histories together with Social Security numbers and insurance information may present materially different issues from an incident involving limited administrative data. If exposed information is later used to obtain medical services, submit insurance claims, or otherwise impersonate a patient, the incident may also involve medical identity theft.

The legal analysis should reflect those differences.

Medical Information Deserves Its Own Breach Analysis

Healthcare breaches are often discussed primarily in terms of cybersecurity.

For the affected patient, the information itself can be just as important.

A medical record can document years of healthcare while also containing information used to identify the patient. When that combination is exposed, the incident can raise privacy, identity, and security concerns at the same time.

Understanding what information qualifies as PHI, who held it, how it was exposed, and which laws protect it provides a clearer foundation for evaluating what happened and what legal options may be available.

Speak With Net Law Advocates About Exposed Medical Records or PHI

A breach involving medical records can expose information that is both personally sensitive and closely connected to an individual’s identity. Whether the exposure creates a viable legal claim depends on the records involved, how the breach occurred, who possessed the information, applicable federal and state law, and the impact on the affected person.

Net Law Advocates represents plaintiffs nationwide in data breach matters. If you received notice that your medical records, protected health information, insurance information, or other sensitive healthcare data was exposed or compromised, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.