RXNT data breach: e-prescribing and practice software data taken March 1 to 3, 2026

Did the RXNT breach affect members of Congress?

Yes. The HIPAA Journal reported on May 15, 2026 that the Office of the Attending Physician, which manages care for members of Congress, uses RXNT's software to send prescriptions to pharmacies, and that some of that prescription information was stolen. The items it listed for those patients are names, addresses, dates of birth, physician names, and prescription and pharmacy information. It reported that the members' medical records, Social Security numbers and financial information were not involved, because only what a prescription needs goes into the software.

The office had not said how many members or staff were affected, the same report said. The 353,844 on the HHS portal is RXNT's figure for all of its customers' patients, not a count for Congress.

Why did patients hear about RXNT months after the attack?

Because RXNT is a business associate: it told the practices that use its software first, and the practices then had to notify their patients. RXNT began notifying its customers on May 1, 2026, about two months after it found the activity on March 3. The HIPAA Journal explained that under the HIPAA Breach Notification Rule a business associate has 60 days to tell its covered-entity clients, and each client then has 60 days to notify individuals, though it can hand that task to the business associate. The HIPAA Breach Notification Rule entry explains the deadlines.

What happened in the RXNT data breach?

RXNT says it became aware on March 3, 2026 of unauthorized activity in one of its software products used by some of its customers, investigated with cybersecurity experts, removed the intruder and notified law enforcement. It began notifying affected customers, the healthcare providers, on May 1, 2026.

Date	What the letter and the regulators' records say
March 1, 2026	The unauthorized actor begins taking data; breach date on California's record and one of Washington's notices
March 3, 2026	RXNT becomes aware of the activity
May 1, 2026	RXNT begins notifying its customers
May 29, 2026	Report submitted to HHS; first notice recorded by California; two Washington notices; report logged in Massachusetts
June 15, 2026	Second notice recorded by California
October 23, 2026	Posted on the Texas attorney general's list

87 days passed between RXNT becoming aware of the activity and the HHS report.

What information was involved?

The letter lists name, date of birth and Social Security number, plus other items that vary by person, and says no payment card, bank account or other financial information was involved. Washington, Texas and Massachusetts all add medical information to Social Security numbers.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	353,844
Texas attorney general	Texans	50,071
Washington attorney general	Washingtonians, two notices (5,671 and 1,215)	6,886
Massachusetts consumer affairs office	Massachusetts residents	5,742

What is RXNT offering people who got a letter?

Epiq Privacy Solutions ID single-bureau credit monitoring for 12 or 24 months, printed on each letter.

Item	Detail from the letter
Provider	Epiq (Privacy Solutions ID)
Length	12 or 24 months
Enrollment	Activation code and deadline printed on each letter
Phone	877-327-7205, Monday to Friday, 8:00 a.m. to 8:00 p.m. Central Time, excluding major U.S. holidays

Why did I get a letter from RXNT?

Your doctor's practice uses RXNT software for prescribing, practice management or health records. The guide to letters from companies you never dealt with explains vendor breaches.

What the documents leave open

• Which RXNT product was affected and how the actor got in.
• How many practices' patients are involved.
• Why Texas's posting came in October, five months after the other records.