Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A healthcare breach notice means an organization believes your information was involved in a security incident; it does not prove that anyone has used it. Start by preserving the notice and following its instructions, then match each response to the information exposed: secure credentials, inspect medical records, challenge suspicious insurance activity, and use credit or identity-theft tools only for credit-related risks.
The steps below are for people in the United States. Keep the notice, use only contact details from the notice or the organization’s official website, and document every call, letter, claim number, and correction request.
What a healthcare breach notice does—and does not—tell you
A notice should identify the incident in brief, describe the types of information involved, explain what the organization is doing to investigate and reduce harm, list steps you can take, and provide a contact method. For a covered entity or business associate reporting a breach of unsecured protected health information (PHI), the U.S. Department of Health and Human Services (HHS) says notice must be sent without unreasonable delay and no later than 60 days after discovery. HHS’s rule page states: “These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach.” The page lists a last-review date of July 26, 2013, so use current HHS guidance or professional advice for a legal determination.
Read the notice for precise terms. “Contact information” might mean names and addresses, while “medical information” could include diagnoses, treatment, prescriptions, laboratory results, or billing details. A notice may say that passwords, account numbers, insurance identifiers, Social Security numbers, or combinations of these were involved. Do not assume that every record held by the organization was exposed, and do not assume that an offered monitoring service covers every person or every type of data. Ask the organization’s official breach contact whether your specific account or identifier was included and whether a paid or free protection offer applies to you.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Unexpected calls, texts, or emails that refer to the incident can be follow-up scams. Do not provide a password, one-time code, insurance number, or payment card to an unsolicited caller. Initiate contact using the telephone number printed on the notice, a member card, or the organization’s official website.
Match the response to the information exposed
| Information identified in the notice | Primary risk to investigate | First place to act | Protection that addresses that risk |
|---|---|---|---|
| Portal, insurer, email, or other credentials; account PINs | Unauthorized sign-in and password reuse | Affected service and the email account used for recovery | New, non-reused passwords or PINs and supported multifactor authentication (MFA) |
| Clinical information, patient identifiers, or medical records | Medical identity theft, altered records, or false billing | Providers, laboratories, hospitals, and the health plan | Record and bill review, written correction requests, and insurer fraud investigation |
| Insurance enrollment, member identifiers, claims, or benefit information | Unauthorized enrollment, claims, provider activity, or exhausted benefits | Health plan fraud unit and the applicable public program | Claim and enrollment investigation and correction of plan history |
| Social Security number or other credit-identity information, or evidence of fraudulent credit accounts | New accounts or other identity theft appearing on credit files | Federal Trade Commission (FTC) identity-theft service and the credit bureaus | Identity Theft Report, credit reports, fraud alert, freeze, and credit-file disputes or blocks |
These responses can overlap. For example, a stolen identifier may require both an FTC recovery plan and a call to your health plan. A credit freeze does not correct a diagnosis, remove an unauthorized medical procedure, or rewrite an insurer’s claim history.
Step 1: Preserve and verify the notice
- Save the original. Keep the letter, email, attachment, or portal message in a secure folder. Record when you received it, the organization’s name, the incident or reference number, the breach contact, and any enrollment deadline for offered services.
- Inventory the data categories. Copy the notice’s wording into your notes. Distinguish credentials and PINs from insurance identifiers, Social Security numbers, and clinical information. “May have included” is not the same as “confirmed for every person,” so preserve that qualification.
- Read the recommended steps. The organization may require a particular enrollment code, password reset process, or call center. Complete those instructions before relying on generic advice, and ask what they know about the scope and dates of exposure.
- Verify through an official route. If the notice is unclear, call the number printed on it or locate the organization’s contact page independently. Ask whether your records were among those involved, which identifiers were exposed, and whether the organization will notify other affected providers or plans.
- Keep a contact log. For every conversation, write the date, representative’s name or identification number, department, case number, promises made, and the date you were told to expect a response.
Step 2: Lock down credentials and recovery channels
Change the password for every affected patient portal, insurer account, pharmacy account, or other service named in the notice. Change any other account that reused the same password, even if that account was not named. Replace account PINs where the service uses them. A password that was unique to one breached portal should still be replaced there; a reused password creates a separate exposure on every service sharing it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Protect the email account that resets other accounts
Secure the email account used for password recovery before changing dependent accounts. Give it a new password that is not used elsewhere, review its recovery address and telephone number, and turn on the MFA options it provides. If an intruder controls the recovery mailbox, a later password reset can undo the other work.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn on supported MFA
Enable MFA in the patient portal, insurer account, and recovery email account when the service offers it. The HHS Office for Civil Rights’ report on calendar year 2024 says compromised credentials remained one of the main attack vectors identified in its investigations and notes that MFA, particularly for remote access, can help limit unauthorized access. That finding concerns regulated organizations’ systems, not a performance test of consumer products, but it supports MFA as a sensible account-hardening measure.
Some services offer an authenticator application, text message, push approval, or a physical FIDO2 security key. A hardware key is optional and useful only where the particular provider supports it; compatibility was not established for every patient or insurer portal. Do not buy one on the assumption that it is required, and do not treat any single MFA method as a substitute for changing a compromised password.
Check for signs of account takeover
After resetting access, review recent sign-ins, profile changes, linked email addresses, saved payment details, and messages sent from the account if those features are available. Remove an unfamiliar recovery method and report it to the service. Save screenshots or downloaded statements showing the account’s status before and after the reset.
Step 3: Look for medical identity theft in records and bills
Medical identity theft can leave an incorrect diagnosis in a chart, a prescription or procedure you never received, or a bill for care delivered to someone else. Review each organization that may hold your information—not only the entity named in the notice. That can include a hospital, physician, clinic, laboratory, pharmacy, and health plan.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Obtain and review records
- Sign in to each available patient portal and download visit summaries, laboratory results, medication lists, problem lists, statements, and explanation-of-benefits documents.
- If a portal does not provide the needed records, ask the provider’s medical-records department how to request them and whether a form, identity check, or fee applies.
- Compare entries with your own calendar, prescriptions, receipts, and appointment history. Mark unfamiliar treatments, diagnoses, medications, providers, dates of service, and charges.
- Look for an explanation for a legitimate claim rejection. A claim may be rejected because the plan says your benefits were exhausted, or coverage may be denied because the plan’s records list a condition you do not have. Each is a warning sign to investigate, not proof by itself that the breach caused the problem.
Request corrections in writing
Write to the provider about each inaccurate entry. Identify the exact document, date, and line or diagnosis; explain why it is incorrect; attach copies rather than originals; and ask the provider to correct the record. Request written confirmation of the outcome and ask that the correction be sent to other providers or organizations that may have received the erroneous information. Keep the original record, your letter, attachments, delivery proof, and the response in your case file.
Notify the health plan
Send the plan’s fraud department a description of unfamiliar care or charges and copies of supporting documents. Ask it to investigate the claim, place an appropriate fraud note on the account, and explain how it will correct its claims history or benefits balance. Use the number on your member card or the plan’s official website, not a number supplied by an unexpected caller.
Step 4: Check insurance enrollment, claims, and benefits
Contact the insurer even when the breach notice came from a provider. Ask whether there are unfamiliar claims, providers, coverage changes, enrollment records, or benefit usage. Request an explanation of any disputed activity and the plan’s process for correcting it. If an incorrect medical record could affect authorization or coverage, tell the plan that the underlying record is being challenged and provide the provider’s correction correspondence.
Recommended Free Tools
Use the channel that matches your coverage
- Employer or individual commercial plan: Call the number on the member card and request the fraud or special-investigations department. Ask for a case number and written instructions for disputing claims.
- Marketplace coverage: For suspected fraudulent Marketplace enrollment, FTC guidance says to contact both the insurer and the Marketplace. Ask each one to verify the enrollment and restore the correct coverage if necessary.
- Medicare: Contact Medicare through its official member channel when claims, providers, or benefits appear unfamiliar.
- Medicaid: Contact the Medicaid agency in your state. State procedures differ, so follow the agency’s instructions for disputed enrollment or claims.
Do not stop at a credit-bureau dispute when the problem is an insurance claim. Credit files and insurer claim systems are separate records and require separate corrections.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 5: Use identity-theft and credit tools for credit risks
If the notice includes a Social Security number or other personal identifier, or if you see evidence of identity theft, use the FTC’s IdentityTheft.gov service to create an FTC Identity Theft Report and a personalized recovery plan. The plan explains which companies and agencies to contact for the type of misuse involved.
Review credit reports
Obtain your free credit reports through the FTC-recommended access route and inspect them for unfamiliar accounts, inquiries, addresses, collection activity, and account changes. Save a copy of each report and mark the entries you dispute. Follow each bureau’s instructions and the creditor’s instructions; a dispute should identify the item, explain why it is inaccurate, and include supporting evidence.
Choose a fraud alert or freeze
A free one-year fraud alert can be placed through one credit bureau; that bureau must notify the other two. A lender seeing the alert should take reasonable steps to verify that an applicant is really you. A credit freeze restricts access to your credit file and can make it harder to open new credit in your name. You can temporarily lift or permanently remove a freeze when you need to apply for credit.
Use these controls for new-credit risk. They do not remove a false diagnosis, correct a treatment date, reverse an insurer’s claim, or restore a misused health benefit. Those problems must be reported to the provider or plan handling the medical record or insurance account.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Dispute or block fraudulent credit information
Ask the credit bureau and the company that supplied the information to investigate unfamiliar accounts. FTC guidance also describes a process for blocking information that resulted from identity theft when you provide the required Identity Theft Report and supporting documents. Keep delivery confirmation and responses, and calendar any deadline for additional information.
Step 6: Escalate suspected privacy-rule violations
The HHS Office for Civil Rights (OCR) accepts complaints alleging that a HIPAA covered entity or business associate violated applicable privacy, security, or breach-notification requirements. OCR also handles complaints involving applicable federal Part 2 protections for substance-use-disorder records. A complaint is different from a request to correct a medical chart: continue working with the provider and plan on the underlying error while you pursue any regulatory complaint.
Not every consumer health application is covered by HIPAA. The FTC’s Health Breach Notification Rule applies to certain personal health record businesses outside HIPAA. The FTC’s breach-reporting form is intended for organizations to report breaches; an individual who suspects medical identity theft should use IdentityTheft.gov and contact the affected provider or insurer. Before filing, identify the company’s role, the kind of data involved, and the specific conduct you believe violated a rule.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What recent breach statistics mean for your situation
HHS OCR’s report published in 2026 for calendar year 2024 found that hacking or information-technology incidents accounted for 81% of reports involving breaches affecting 500 or more individuals and 99% of the individuals affected in that group. For breaches affecting fewer than 500 individuals, 94% of reported breach types were classified as unauthorized access or disclosure. These percentages describe aggregate reports by breach size and year; they do not estimate the probability that your information will be misused or show that a particular notice resulted from hacking.
The same report’s discussion of compromised credentials and MFA is relevant to account hardening, but it does not evaluate any specific consumer portal, insurer, authenticator, or security key. Treat the statistics as context for acting promptly, not as evidence about the outcome of your individual case.
Build a case file and follow through
Use one secure folder—digital, paper, or both—for the notice, your data inventory, account-reset confirmations, credit reports, bills, explanations of benefits, correction requests, identity-theft reports, and every response. Use a simple index with the organization, issue, date opened, case number, next action, and due date. When you mail a correction or dispute, keep a copy and proof of delivery.
Review new statements and explanations of benefits as they arrive. Compare them with appointments you actually attended and medicines you received. If an organization says an investigation is complete, request the result in writing and ask what was changed, what remains disputed, and how future claims will be screened. Escalate through the plan’s formal appeal or complaint process when a correction or claim investigation is denied, and retain the denial with your other records.
Quick Recap
Mistakes that leave gaps after a breach
- Waiting for proof of misuse: A notice is not proof that someone used your data, but exposed credentials should be changed promptly because delay gives a reused password more time to work elsewhere.
- Using the caller’s contact information: Verify the organization independently before discussing medical or insurance details.
- Changing only one password: Reused credentials and the recovery email account must be addressed together.
- Freezing credit and stopping there: A freeze protects new-credit applications, not medical records, claims, enrollment, or benefits.
- Assuming all health apps follow HIPAA: Coverage depends on the organization’s legal role and the rule involved; some businesses fall under the FTC Health Breach Notification Rule instead.
- Sending original documents: Provide copies, keep the originals, and record when each organization received your submission.
- Buying monitoring before using free remedies: Start with the notice’s instructions, the FTC’s identity-theft recovery plan, free credit reports, fraud alerts, freezes, and the provider and plan complaint channels that address the actual problem.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
