Elara Caring data breach: a document-signing vendor's system, and home health patients' files

What happened?

Elara says its own systems were not affected. The vendor told it on December 12, 2025, and Elara then reviewed the documents. On March 12, 2026 it determined that patients' personal information was among the files downloaded. The letter does not name the vendor.

Date	What the letter and the regulators' records say
November 4 to 6, 2025	First window of access to the vendor's system
November 14 to 17, 2025	Second window
December 12, 2025	Vendor notifies Elara
March 12, 2026	Elara finds patients' information in the downloaded documents
May 12, 2026	Letter date; logged in Massachusetts (714 residents)
June 23, 2026	Report to HHS (22,172)

The letter gives two separate windows, eight days apart. The vendor told Elara 25 days after the second one closed.

Which vendor was behind the Elara Caring breach?

Elara's letter does not name it. The HIPAA Journal, reporting on May 18, 2026, wrote that the dates of access match Doctor Alliance, a platform for managing electronic physician signatures. That identification is the publication's own, made from the dates, not Elara's. The letter's description of the vendor, a third party Elara used to manage and sign documents, fits that kind of service.

What information was taken in the Elara Caring breach?

The filed sample letter leaves the list blank, but The HIPAA Journal reported the items in the letters people received: names, addresses, dates of birth, medical records, Social Security numbers and health insurance information. Massachusetts's record agrees on Social Security numbers and medical records for its 714 residents.

How many Elara Caring patients were affected?

Record	Who it counts	Number
HHS Office for Civil Rights (report of June 23, 2026)	Individuals	22,172
HHS figure reported by The HIPAA Journal, May 18, 2026	Individuals	10,490
Texas attorney general, May 14, 2026	Texans	3,311
Texas attorney general, June 25, 2026	Texans	2,631
Massachusetts consumer affairs office	Massachusetts residents	714

In May, The HIPAA Journal reported that HHS had been told of 10,490 people. The HHS record this entry cites, filed on June 23, counts 22,172. Together with the second Texas report two days later, that points to a second, larger round of notice, though no record says so outright.

What did Elara change?

Elara says it ended its relationship with the vendor and is reviewing its security policies, including those for third-party vendors. The guide to vendor breach notices compares how other companies describe a vendor's breach, and the guide to letters from companies you never dealt with covers the reverse case.

What information was involved?

Elara Caring's sample letter leaves the list of data items blank. For the 714 Massachusetts residents in Elara Caring's notice, the state's record marks Social Security numbers and medical records as breached.

What is Elara offering?

Item	Detail from the letter
Service	Credit monitoring and remediation, 24 months
Provider	Cyberscout, a TransUnion company

The guide to credit monitoring offers sets Elara Caring's offer beside other letters.

What Texas's attorney general recorded

Texas's attorney general lists two reports from Elara Caring: 3,311 Texans, posted on May 14, 2026, and 2,631 Texans, posted on June 25, 2026. The public list does not say whether the second report adds people to the first or restates them, so the two figures may overlap.

What the documents leave open

• Which vendor was breached, and how; Elara has not confirmed The HIPAA Journal's identification.
• Why the HHS report, filed six weeks after the letters, records email as the location of the data.

With 22,172 people, Elara Caring's report is the 116th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.