Point32Health, the Massachusetts-based parent company of Harvard Pilgrim Health Care and Tufts Health Plan, disclosed an unauthorized data disclosure incident after discovering on September 29, 2026, that a provider credentialing form had been sent to unauthorized recipients. An employee in provider services mistakenly emailed the document containing personal information to eight other healthcare providers. Individual notification letters were subsequently mailed on October 28, 2026.
The exposed information included names, dates of birth, addresses, and Social Security numbers. No medical records, clinical details, or financial account numbers were reported as compromised. The total number of affected individuals has not been publicly released.
Point32Health requested that all eight unintended recipients delete and destroy the form and provide written confirmation. Regulatory filings were submitted in Massachusetts, and additional details regarding the total scope of the incident remain unconfirmed.