CommuniCare Data Breach Affects 19,885 Texans: PHI and PII Exposed

Barrio Comprehensive Family Health Care Center, also known as CommuniCare, recently experienced a data security incident that has so far affected 19,885 individuals in Texas.

On Sept. 16, 2025, the organization discovered suspicious activity involving an employee email account. Action was taken to secure the email system and network, and third-party cybersecurity specialists were engaged to investigate the scope and nature of the incident.

The investigation determined that a limited number of emails in an employee’s account were subject to unauthorized access. As a result, a comprehensive review of the compromised emails was conducted to identify the type of information exposed and the individuals affected. This review concluded on Feb. 19, 2026.

The data set impacted in this breach included both personally identifiable information (PII) and protected health information (PHI).

Specifically, the exposed information may have included first and last names, dates of birth, health insurance account member numbers, medical diagnosis information, provider location, patient account numbers, health insurance account numbers, clinical information, health insurance group numbers, medical treatment or procedure information and prescription information.

The breach was reported to the Texas Attorney General on March 9, 2026. Additionally, the organization posted a notice of the incident on its website.

CommuniCare's response

To assist those affected, CommuniCare has established a dedicated toll-free helpline at 1-833-289-5065, available Monday through Friday from 8 a.m. to 8 p.m. Eastern Time.

The organization also recommends obtaining free credit reports from the three major credit bureaus and considering placing a fraud alert on credit files. Additional resources and detailed steps for protecting personal information are outlined in the official notice to consumers.

Given that the breach involved unauthorized access to an employee email account, it is especially important for affected individuals to remain vigilant for identity theft or fraud.

Promptly reporting any suspicious activity to financial institutions, insurance providers or law enforcement is advised.