Gastro Health data breach: a phishing incident, and two reports to HHS on the same day

What happened at Gastro Health?

Gastro Health says it contained the incident, investigated, and reviewed the affected files, which held some patients' information. It says the incident is contained and it has no sign of fraud or misuse.

Date	What the letter and the regulators' records say
February 25, 2026	Gastro Health becomes aware of the phishing incident
May 22, 2026	Two reports to HHS (35,632 and 1,628); Indiana notice (55 residents); logged in Massachusetts (291 residents)

The reports came 86 days after Gastro Health became aware. Indiana uses the larger HHS figure, 35,632, as the total. Together the two HHS reports come to 37,260; neither record says why the incident was split into two.

Which Gastro Health patients were affected?

Gastro Health's letter does not say which offices the affected patients used. The group is large: The HIPAA Journal describes it as a gastroenterology medical group with more than 200 locations in Florida, Alabama, Washington, Virginia, Ohio, Massachusetts and Maryland. The state records match that spread: Washington counts 1,813 residents, Massachusetts 291 and Indiana 55. The same report says both HHS filings of May 22, 2026 are believed to relate to the one phishing attack.

Record	Who it counts	Number
HHS Office for Civil Rights, first report	Individuals	35,632
HHS Office for Civil Rights, second report	Individuals	1,628
Washington attorney general	Washingtonians	1,813
Massachusetts consumer affairs office	Massachusetts residents	291
Indiana attorney general	Indiana residents	55

What information was involved?

The data varied by person. It may include name, Social Security number, date of birth, state ID number, medical record number, patient account number, Medicare or Medicaid number, health insurance or group account number, diagnosis or treatment information, and provider or clinic information. The letter says no payment card information was involved.

What is Gastro Health offering?

Item	Detail from the letter
Service	24 months of Epiq Privacy Solutions ID: three-bureau credit monitoring with alerts, a monthly credit score, Social Security number monitoring and more
Enrollment	www.privacysolutionsid.com, with the code and deadline printed on the letter

The guide to credit monitoring offers sets Gastro Health's offer beside other letters, and the guide to healthcare provider breach notices compares other practices' letters.

What Washington's attorney general recorded

Washington's attorney general lists a report from Gastro Health, received on May 22, 2026, with 1,813 Washington residents affected and a breach date of February 24, 2026. For those residents the record lists names, Social Security numbers, driver's license or state ID numbers, dates of birth, health insurance policy or ID numbers, medical information and protected health information owned or licensed by a hipaa covered entity as compromised.

What the documents leave open

• How many staff accounts the phishing reached.
• Why there are two HHS reports for the same day.

With 35,632 people, Gastro Health's report is the 88th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.