HealthStream Data Breach Exposes Social Security Numbers

HealthStream Inc, a Nashville-based healthcare technology company, disclosed a data breach that involved sensitive personal information.

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 14, 2026. The total number of individuals affected across the United States.

HealthStream's notification to affected individuals provided very limited detail about the nature of the incident. The letter did not describe the method of attack, when the breach took place, when it was discovered or what steps the company took to investigate the scope of the exposure.

Because of this limited disclosure, key details about the breach remain unclear.

The types of personal information exposed in the breach included Social Security numbers and driver's licenses.

HealthStream's response to the breach

HealthStream is offering 24 months of free credit monitoring and identity theft protection services through Epiq Privacy Solutions ID.

To enroll, affected individuals should visit www.privacysolutionsid.com, click "Activate Account" and enter the activation code included in their notification letter. Each letter contains a specific enrollment deadline. Individuals who need help with enrollment or have questions about the monitoring services can call Epiq directly at 866-675-2006, Monday through Friday from 9 a.m. to 5:30 p.m. ET.

HealthStream has also set up a dedicated assistance line for questions about the incident. Affected individuals can call 888-650-4098, Monday through Friday from 9 a.m. to 9 p.m. ET, excluding major U.S. holidays. Individuals may also write to HealthStream Inc at 500 11th Ave. N., Suite 850, Nashville, TN 37203.