Brown Health Medical Group-MA data breach: a historic file server at the Hawthorn practice

What happened at Brown Health Medical Group-MA?

The practice says it isolated the server as soon as it found the incident, and investigated. It could not determine exactly which information was affected. On June 22, 2026 it settled the scope of what may have been, and it is notifying people as a precaution. It notified law enforcement, is retraining staff and has added technical safeguards.

Date	What the letter and the regulators' records say
December 15 to 16, 2025	Unauthorized access to the historic file server
December 16, 2025	The practice learns of the incident and isolates the server
June 22, 2026	Scope of the information that may be involved determined
July 16, 2026	Report to HHS (311,760); logged in Massachusetts (290,357); Indiana notice date

The reports to regulators came seven months after the incident and 24 days after the scope was set.

What information was involved?

The letter names three groups of information; not every group applies to every person.

Group	Examples in the letter
Demographic information	Name, date of birth, contact information
Personnel and human resources records	Compensation or payroll, licensure or credentialing, medical or disability-related records
Other personal information	Social Security, driver's license or other government ID numbers, credit or debit card numbers, financial account information

Because personnel and credentialing records are on the list, letters can reach staff and clinicians as well as patients. Massachusetts' record marks all five of its categories as breached: Social Security numbers, medical records, financial accounts, driver's licenses and payment cards.

Why did I get a letter from Brown Health Medical Group-MA?

The letter concerns an event at the practice's Hawthorn location, and goes to people whose information was on the historic file server there. It is sent under the practice's legal name, Lifespan Physician Group of Massachusetts, so the name on the envelope may not be the one you know.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	311,760
Massachusetts consumer affairs office	Massachusetts residents	290,357
Indiana attorney general	Total affected (1 Indiana resident)	311,760

What is the practice offering?

Two years of Experian IdentityWorks at no cost, with identity restoration and fraud detection.

Item	Detail from the letter
Provider	Experian IdentityWorks
Length	Two years
Questions about the incident	833-918-0243, 8 a.m. to 8 p.m. Central Time

What the documents leave open

• How the intruder reached the server, and why a historic server still held these records.
• Which information was taken; the practice says it could not determine this.
• How many of the 311,760 are patients and how many are staff.