Healthcare provider breach notices: what clinics and medical groups tell patients

What the documents cover

This guide draws on three notices filed with the California Attorney General in October 2026. They come from BASS Medical Group (filed October 22, 2026), Blossom BH Opco Inc., which operates as Blossom Health (filed October 29, 2026), and Neuro Wellness Spa (filed October 16, 2026). The question also names Blueberry Pediatrics, but no Blueberry Pediatrics notice was among the documents provided, so nothing is reported about it here.

The three notices describe different kinds of incidents. BASS reports suspicious activity in its network. Blossom Health reports a phishing-driven intrusion into its electronic health records system. Neuro Wellness Spa reports a file emailed to the wrong person. The sections below take the questions in order: how it happened, what data was involved, and what patients are offered.

How each incident happened

BASS Medical Group's announcement is dated Walnut Creek, CA, October 22, 2026. It says that on or around September 4, 2026, the group found suspicious activity on its network. The announcement says it then launched an investigation with independent cybersecurity experts to identify the source and scope of the incident. According to BASS, on or about September 22, 2026, the investigation found that information may have been taken. The announcement does not name the method of entry.

Blossom Health's letter is the most specific about cause. It states that on August 27, 2026, an unauthorized actor got into its electronic health records software. The letter says the investigation found that the actor entered through a phishing attack on a contractor who was not an employee. The letter adds that the actor had access to patient information before being detected and removed.

Neuro Wellness Spa describes no outside attacker. Its notice says that on August 24, 2026, a file containing patient information was emailed to another patient instead of the intended document. The spa says it learned of this on September 16, 2026, from that other patient.

What health data was involved

BASS lists a narrow set of categories. Its announcement says the information that may have been involved was medical treatment codes or billing information and health insurance information. It adds that not all of this information was involved for every individual.

Blossom Health says its review found that viewed patient information may have included names, contact information and health insurance information. The letter also says the actor could not reach Social Security numbers or payment card data.

Neuro Wellness Spa gives the longest list, because the exposed item was a patient file. Its notice says the file may have included service and billing details such as dates of service, provider names, places of service, chart and claim identification numbers, and procedure codes. It also lists payment details. The notice states that its investigation found no Social Security numbers, driver's license numbers or credit card numbers in the file.

What each organization says it did

BASS says it moved to contain the incident and added safeguards afterward. The announcement says it set up a toll-free call center for questions. It also says it told the California Attorney General, the FBI and the U.S. Health and Human Services Office for Civil Rights.

Blossom Health says it removed the actor and tightened its environment. According to the letter, it changed user passwords and added technical and security measures.

Neuro Wellness Spa says it contacted the person who received the file and asked for deletion. The notice says confirmation of deletion was still in progress. It also says the spa has strengthened its tools and training.

What protections patients are offered

Only one of the three notices includes a paid service. Blossom Health's letter offers credit monitoring, a credit report and a credit score at no charge. The letter sets a deadline: patients must enroll within 90 days of the date of the letter. It also says the service may not be available to people under 18. The Blossom Health document is marked "Draft" in several places and contains placeholder text, so the final mailed letter may differ from what was filed.

BASS and Neuro Wellness Spa direct patients to steps they can take themselves. The BASS announcement says it is giving this information to help people who want to know more about protecting themselves. Neuro Wellness Spa recommends that patients check their statements.

All three notices also include standard credit-file guidance, covered next.

Credit-file steps and statements on misuse

The three notices explain fraud alerts and security freezes in similar terms, with small differences. Neuro Wellness Spa says an initial fraud alert is free and lasts at least one year, and that an extended alert lasts seven years. Blossom Health's letter gives a one-year term for an initial alert. On freezes, Blossom Health states that there is no cost to freeze or unfreeze credit files.

Each organization says it has no evidence of misuse. BASS says it has no evidence of misuse or attempted misuse. Blossom Health says there is no evidence that personal information has been misused. Neuro Wellness Spa says it is not aware of any misuse of the patient's information. Its notice makes that statement before listing its recommended steps.

For patients, the practical differences in these three filings are the cause of the incident, the data categories listed and whether a monitoring offer came with the letter. The Blossom Health letter lists a call-in number with Eastern time hours, the BASS announcement lists a call center with Pacific time hours, and Neuro Wellness Spa lists its privacy office by phone and email.