Acadia Healthcare Company reported a data security incident where patient information was compromised. This breach, stemming from an employee's email and SharePoint account, occurred between March 21 and March 25, 2026. The company officially disclosed the incident and began notifying affected individuals on May 22, 2026, and also posted an official notice on its website.
The confirmed data types exposed include names, Social Security numbers, dates of birth, addresses, government IDs, medical information (treatment info, diagnosis codes, dates of treatment), financial information (health insurance info, Medicare HICN), and government identifiers. A total of 1,807 individuals were affected, with 405 of those being Massachusetts residents. The full extent of affected individuals remains under review by the HHS Office for Civil Rights, though an initial report estimated at least 501 individuals were impacted. The breach was limited to one email and SharePoint account and did not involve the electronic medical record system.
Details about this incident can still emerge as investigations are ongoing and notifications may be delayed.