A contractor’s phished credentials opened the electronic health record at Blossom Health, and the virtual psychiatry provider is now telling patients what walked out the door with them.
The intrusion was found on August 27, 2026. Investigators traced it to a phishing attack against a non-employee contractor, which gave the intruder a way into the EHR software. The disclosure says a limited number of patient medical records were downloaded, along with a user spreadsheet full of patient details. Names, contact information, and health insurance information were involved. Blossom Health says financial account data and Social Security numbers were not accessible, though its notice does not explain how that was established.
Containment ran the usual course. Access was cut off, user passwords were reset, and additional technical controls went in. Patients were offered a single-bureau credit report, score, and monitoring.
The Texas attorney general was told 2,103 residents were affected. A national total has not been published, which is common for smaller operators that file state-by-state.
Behavioral health data carries outsized resale value because it is hard to reissue and easy to use against someone. For covered entities relying on staffing contractors inside a clinical system, the controls that matter are scoped accounts, short session windows, and phishing-resistant login for anyone who touches the record, not annual awareness modules. Ask your EHR vendor for privileged-access reports on non-employee accounts this month.
