Aprendamos Intervention Team, P.A. Data Breach 2025: 1,916 Affected · Insider Email Exfiltration · NM. Filed With HHS OCR. What To Do.

Aprendamos Intervention Team, P.A. — a pediatric early-intervention and developmental therapy provider based in Las Cruces, New Mexico — filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on January 23, 2025, reporting 1,916 affected individuals. According to the entity’s own public notice, a departing employee transferred electronic protected health information to a personal external email account on their last day of employment on December 4, 2024. Aprendamos has characterized the incident as unauthorized internal exfiltration; it has stated it has no indication the data has been further accessed or misused by any third party.

Timeline

• December 4, 2024 — A departing Aprendamos employee transferred electronic PHI to an external personal email account on their last day of employment. The transfer was identified through internal review the same day.
• December 2024 – January 2025 — Aprendamos conducted an internal investigation to determine the scope of records involved and engaged outside cybersecurity counsel.
• January 23, 2025 — Aprendamos filed a breach report with HHS OCR covering 1,916 individuals.
• February 28, 2025 — Aprendamos issued public notice under 45 CFR § 164.406 (HIPAA media-notification requirement for breaches affecting more than 500 residents of a state or jurisdiction), began direct outreach to impacted clients and employees, and opened a dedicated hotline at (575) 323-9705.

What was exposed

Based on the entity’s own statements to local media, the data elements involved were primarily:

• Names
• Dates of birth
• Protected health information associated with early-intervention services (the specific clinical fields have not been enumerated in public statements; individual notification letters identify the elements applicable to each recipient)

Aprendamos has reported the breakdown publicly as approximately 1,895 clients and 101 employees. The HHS OCR portal aggregates this as 1,916 affected individuals under a single covered-entity filing.

A sensitive population: pediatric early-intervention clients

Aprendamos is an Early Intervention (Part C of IDEA) and developmental therapy provider in southern New Mexico. Its client population is overwhelmingly children from birth to age three with diagnosed developmental delays or disabilities, along with their families. This profile makes the breach materially more sensitive than a comparable adult-population incident:

• Records concerning minors with developmental conditions can follow a child through decades of educational, medical, and insurance interactions.
• Dates of birth for very young children, combined with names, create a long-tail synthetic-identity risk that does not surface until the child applies for credit as a young adult.
• Some impacted families may have additional indicators in their records (Medicaid eligibility, IFSP/IEP references, diagnostic terminology) that, even if not enumerated in the public notice, would warrant scrutiny of the individual letter when received.

What Aprendamos is offering

Per the entity’s public notice:

• Free credit monitoring at no cost to eligible clients. The notice does not specify the credit-monitoring vendor or duration in publicly available reporting; the individual notification letter is the controlling document.
• A dedicated hotline at (575) 323-9705 for client questions.
• A stated commitment to a comprehensive review of security protocols and engagement with cybersecurity experts.

Class-action status

As of the date of this page, no class-action complaint against Aprendamos Intervention Team, P.A. arising from the December 2024 incident appears in the major class-action trackers (ClassAction.org, TopClassActions, DataBreachLawsuit.org). The HHS OCR entry remains open and under review.

What to do if you may be affected

• Read your notification letter carefully. It will name the specific data elements exposed for you (or your child) and the exact terms of any credit-monitoring enrollment offered, including the activation code and deadline.
• For affected minors: request a minor’s credit freeze from each of the three nationwide consumer reporting agencies. Freezing a child’s credit before any synthetic-identity activity begins is the single most effective protection. It is free under federal law.
• For affected adults (employees and parents): place a credit freeze on your own files at Equifax, Experian, and TransUnion.
• Review benefit statements — if your child receives Medicaid or commercial insurance for therapy services, watch Explanation of Benefits documents for services you did not receive.
• Call the dedicated hotline at (575) 323-9705 with specific questions about whether you or a family member is affected.
• Bookmark this page. We update it as the OCR matter progresses, individual notification letters surface, or any litigation is filed.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• KTSM 9 News — Las Cruces organization reports data breach of health information — local-press summary of Aprendamos’ public notice, including the December 4, 2024 incident date and the (575) 323-9705 hotline.
• Yahoo News syndication of the KTSM report — corroborating coverage with affected-count breakdown (1,895 clients and 101 employees).
• Aprendamos Intervention Team — official site — entity homepage and service description.
• Aprendamos Early Intervention — sharenm.org service profile — independent description of Aprendamos’ Part C early-intervention services.
• New Mexico Disability Finder — provider record — state-affiliated directory confirming provider scope and location.