Acadia Healthcare data breach letter: an email incident in March and July 2026 reached patients' files

Date	Event
March 21 to 25, 2026	Files accessed and acquired
March 25, 2026	Acadia first learns of the incident
July 13, 2026	Files accessed and acquired again
August 21, 2026	Acadia determines whose information was in the files
November 13, 2026	Notice posted by the California attorney general

What happened in the Acadia Healthcare data breach?

The letter calls it an email security incident that led to unauthorized access to certain files. Acadia says it began an investigation with a third-party forensic firm as soon as it learned of the incident on March 25. The investigation found that the electronic health record systems were not involved and that the incident did not disrupt operations or patient care. The letter does not explain the second access date, July 13, which falls more than three months after Acadia first learned of the incident. Nor does it say how the email accounts were compromised. Acadia says it is giving its providers and staff additional cybersecurity training.

Who is Acadia Healthcare?

Acadia's quarterly report describes subsidiaries that run acute inpatient psychiatric facilities, specialty treatment facilities, comprehensive treatment centers, residential treatment centers and outpatient behavioral health services. At September 30, 2026 they operated 280 facilities with about 12,800 beds. Its principal executive offices are in Franklin, Tennessee. The letter does not name a facility.

What does Acadia's quarterly report say about the incident?

Acadia's 10-Q for the quarter to September 30, 2026, filed November 4, does not describe this incident. Its cautionary statements say in general terms that the company has experienced, and may again experience, cybersecurity incidents that could lead to unauthorized access to data. As of November 14, 2026, Acadia's SEC filing list showed no Form 8-K about it. The guide to Item 8.01 versus Item 1.05 explains when a company has to.

Why did the Acadia letter take so long?

Acadia learned of the incident on March 25, 2026, and the California posting is dated November 13: 233 days later. It knew whose information was in the files on August 21, 84 days before the posting. The HIPAA rule requires notice to each person without unreasonable delay and no later than 60 calendar days after a breach is discovered. The California posting date may be later than the date the letters were mailed, since the template's date line is blank. The notice-delay guide compares the gap with other notices, and the HIPAA Breach Notification Rule entry explains how discovery is defined.

What is Acadia offering people who got the letter?

A one-year membership in credit monitoring and identity theft protection through Epiq Privacy Solutions, at no cost. The activation code and enrollment deadline are printed on each letter. Questions go to 888-500-5708, Monday through Friday, 8 a.m. to 8 p.m. Central. Healthcare data breach letters shows what other providers' letters offer.