Brown Health Medical Group Data Breach Impacts 311K Patients

Brown Health Medical Group-MA, the trade name for Lifespan Physician Group of Massachusetts Inc., disclosed a data breach that occurred at its Hawthorn location in December 2025.

The breach involved unauthorized access to a historic file server at the Hawthorn location of Brown Health Medical Group-MA. The company first became aware of the incident on Dec. 16, 2025. Through its investigation, it determined that the unauthorized access to the server occurred between Dec. 15 and 16, 2025.

The incident did not affect the Practice's electronic health record system, according to the company. However, the compromised file server contained a wide range of sensitive data. On June 22, 2026, roughly six months after discovering the breach, the company completed its review and determined the scope of personal information that may have been involved.

The types of information potentially exposed included both personally identifiable information and protected health information. The personally identifiable information may have included names, dates of birth, contact information, Social Security numbers, driver's license numbers, other government-issued identification numbers, credit or debit card numbers and financial account information.

The protected health information may have included health insurance information, medical information and billing, claims and payment information.

For a subset of affected individuals, the breach may have also involved personnel and human resources records. According to the company's notification, these records included compensation or payroll information, licensure or credentialing information and medical or disability-related records. Not all categories of information were affected for every individual.

So far, 290,357 Massachusetts residents and 86 Vermont residents were impacted. According to a disclosure filed with the Dept. of Health and Human Services, 311,760 people have had their protected health information exposed.

The company began notifying affected individuals on July 16, 2026, and also posted a substitute notice on its website.

Brown Health Medical Group-MA's response to the breach

The company is offering affected individuals two years of complimentary identity protection services through Experian IdentityWorks. After the two-year membership period ends, individuals will still have access to identity restoration support through Experian IdentityWorks ExtendCare.

Affected individuals who received a notification letter will find an activation code and enrollment instructions included with their letter. Enrollment must be completed by Oct. 31, 2026.

The company has set up a dedicated phone line for questions about the incident. Individuals can call 833-918-0243 between 9 a.m. and 9 p.m. Eastern Time, Monday through Friday, excluding major U.S. holidays.