Sharecare Health Data Services breach: records request files taken around July 17, 2026

Date	Event
On or about July 17, 2026	Systems accessed; files taken
August 19, 2026	Review finds the affected systems held personal information and/or protected health information
November 6, 2026	Date on the letters
November 10, 2026	Massachusetts logs the notice (5 residents)

What does Sharecare Health Data Services do?

It handles records release for health providers: when a patient, a patient's lawyer or another requester asks a provider for records, Sharecare produces them. That is why the letter comes from a company most recipients have never heard of: each letter names the provider Sharecare was working for, and says that provider asked Sharecare to send the notice directly. Why you got a breach letter from a company you never dealt with explains how a vendor ends up holding your data, and business associate defines the HIPAA role.

What information was exposed?

Not the medical records. The files taken were the paperwork around requests. The letter lists the person's full name and leaves the rest as a field filled in per letter. Massachusetts marks medical records as involved and no Social Security, financial account, driver's license or card numbers.

Document type	Taken
Records request pages	Yes
Authorization documents	Yes
Other request-related documents	Yes
The medical records themselves	No, according to the letter

What is Sharecare offering?

The filed letter does not describe a credit monitoring offer. It sets out steps people can take themselves: a fraud alert or a security freeze, free credit reports, and close watch on account statements. It adds a section on protecting medication information. Sharecare says it has no knowledge that anyone's information has been or will be misused. Credit monitoring offers in breach letters shows how often letters include one.

Has Sharecare Health Data Services had a breach before?

Yes. In 2018, HIPAA Journal reported, the company detected abnormal network activity on June 26, 2018, and found that hackers had had access to systems with protected health information since May 21, 2018. Its clients' notices followed months later: AltaMed said 5,500 of its patients were affected, and the federal breach portal listed 18,416 Blue Shield of California members. In 2018 the counts came from the clients' own notices; the 2026 letter, too, is sent for a named provider.

Where can I compare other records vendor breaches?

Vendor breach notices shows how other vendors describe a breach at one remove from the patient, healthcare provider breach notices covers the providers' side, and the health care hub lists every health care notice on record.