Kern Psychiatric Health and Wellness Center data breach: patient files on its manager's network

What happened?

The letter puts the intrusion on Genesis's network, not the center's own. The investigation found that certain files on that network, which holds some of the center's data, were accessed without authorization. The center then reviewed those files to see what they held and whom they concerned.

Date	What the letter and the regulators' records say
April 16, 2026	Date of breach on the California record
June 22, 2026	Genesis finds unusual activity on its network
August 19, 2026	Letter date
August 21, 2026	Report to HHS (51,352); notice recorded by California
August 29, 2026	Logged in Massachusetts (6 residents)

The California record dates the breach to April 16, about ten weeks before Genesis found the activity; the letter itself gives no start date. The center's HHS report marks "No" in the column for a business associate, although the letter places the incident at the management company.

What information was involved?

The letter lists the reader's name together with one or more of these, where the center held them: Social Security number, driver's license or other government ID number, date of birth, diagnosis and treatment information, prescription information, provider name and location, dates of service, medical record number, patient account number, Medicare or Medicaid ID number, lab results and health insurance information. Massachusetts' record for its six residents marks Social Security numbers, medical records and driver's licenses as breached.

What did Genesis and the center do?

The letter says Genesis worked with specialists on the investigation, added security measures, notified law enforcement and is reviewing its data protection policies. It also says Genesis took steps to make sure the data was re-secured and not distributed, and that the center knows of no fraud or publication resulting from the incident. The letter does not say what those steps were.

What is the center offering?

Item	Detail from the letter
Service	Single-bureau credit monitoring, credit report and credit score, for 12 months
Provider	Cyberscout
Enrollment	Within 90 days of the letter date, at bfs.cyberscout.com/activate, with the code printed on the letter
Questions	1-866-906-8720, 8:00 a.m. to 8:00 p.m. ET, Monday to Friday, excluding holidays; or P.O. Box 82193, Bakersfield, CA 93380

If you received a letter from a provider whose vendor or manager was breached, the guide to vendor breach notices explains how these letters are structured, and the guide to letters from companies you never dealt with covers the reverse case.

What the documents leave open

• What happened on April 16, 2026, the date on the California record.
• Whether other providers managed by Genesis were affected.
• How the intruder reached Genesis's network.