Griffin -- Brightmoor Hospice, LLC began mailing breach notifications on October 16, 2026, after two employee email accounts were accessed without authorization and found to contain protected health information of certain patients.
Unauthorized access lasted two days in March 2026
Brightmoor discovered suspicious activity on or around March 25, 2026. Third-party specialists determined that the two accounts were accessed between March 24 and March 25, 2026. The company secured the accounts immediately and began reviewing their contents.
Review confirmed patient data on August 18, 2026
Brightmoor determined on August 18 that protected health information was present in the accounts. It then reviewed internal records to locate addresses for potentially affected individuals. Mailing began 59 days later. The company has not stated how many individuals are affected.
Exposed records range from Social Security numbers to treatment details
The data varies by individual and may include names, addresses, Social Security numbers, driver's license information, dates of birth and patient identification numbers. Clinical data may include diagnosis, medical history, medical record numbers, treatment information, lab results, treating doctor's name, medication and vaccination information, and family and social history. Medical insurance information may also be affected.
Brightmoor offers credit monitoring and notifies federal regulator
Brightmoor reports no evidence of actual or attempted misuse of the information. It is offering complimentary credit monitoring and has notified the U.S. Health and Human Services Office for Civil Rights. Individuals are advised to monitor account statements and explanation of benefits forms for suspicious activity and errors.
The company worked with third-party specialists to implement additional security measures in its network and is reviewing further enhancements. A toll-free call center operates Monday through Friday, 8 AM to 8 PM EST, excluding holidays.