How do I know if I am affected by the Barrio Comprehensive Family Health Care Center data breach?

Barrio Comprehensive Family Health Care Center is mailing notification letters directly to affected individuals. If you have received care or services from Barrio Comprehensive Family Health Care Center (also operating as CommuniCare Health Centers) in the period leading up to March 2026 and you have not received a letter, contact the entity directly. 19,971 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Barrio Comprehensive Family Health Care Center breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Date of birth, Health insurance account / member / group number, Clinical information, Diagnoses, Medical treatment / procedure information, Prescription information, Provider locations, Patient account numbers.

Was Barrio Comprehensive Family Health Care Center attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Barrio Comprehensive Family Health Care Center breach. The incident is categorized in the HHS OCR portal as a phishing.

Should I file a lawsuit over the Barrio Comprehensive Family Health Care Center data breach?

1 plaintiffs' firms have publicly announced investigations or filed complaints related to the Barrio Comprehensive Family Health Care Center breach: Lynch Carpenter (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

What is HealthConsent and how does it help with the Barrio Comprehensive Family Health Care Center breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Barrio Comprehensive Family Health Care Center addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker San Antonio, TX Disclosed March 8, 2026

Barrio Comprehensive / CommuniCare Health Centers Data Breach 2026: 19,971 San Antonio FQHC Patients Exposed via Employee Email. What To Do

Barrio Comprehensive Family Health Care Center (operating as CommuniCare Health Centers), a San Antonio FQHC serving Bexar, Kendall, Hays, and Comal counties, disclosed in March 2026 a September 2025 employee email compromise exposing names, dates of birth, health insurance, and clinical information for 19,971 patients. No SSN or financial data in scope. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Sep 16, 2025

Suspicious activity on employee email account; network secured

Sep 16, 2025

Attacker gained access

Feb 19, 2026

Investigation / document review concludes

Mar 6, 2026

Public notice posted to communicaresa.org

Mar 8, 2026

Filed with HHS OCR

Mar 9, 2026

Texas AG filing

Sep 16, 2025

Suspicious activity on employee email account; network secured

Sep 16, 2025

Attacker gained access

Feb 19, 2026

Investigation / document review concludes

Mar 6, 2026

Public notice posted to communicaresa.org

Mar 8, 2026

Filed with HHS OCR

Mar 9, 2026

Texas AG filing

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth

Health records

Don't expire and can't be reissued

Clinical information Diagnoses Medical treatment / procedure information Prescription information

Contact & insurance

Phishing + targeted scams

Full name Health insurance account / member / group number Provider locations Patient account numbers

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Lynch Carpenter (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Barrio Comprehensive Family Health Care Center is a Texas non-profit Federally Qualified Health Center founded in 1972 by Sister Dolores Girault. Operating today as CommuniCare Health Centers, it serves Bexar, Kendall, Hays, and Comal counties from a network of San Antonio-area clinics offering family medicine, pediatrics, OB/GYN, dental, behavioral health, and optometry.

On September 16, 2025, the organization detected suspicious activity on an employee email account, secured the network, and engaged third-party forensics. The forensic review concluded on February 19, 2026. A public notice was posted to communicaresa.org on March 6, 2026, the HHS OCR filing followed on March 8, 2026, and the Texas AG filing on March 9, 2026 — confirming 19,971 affected individuals.

The breach vector was business email compromise — unauthorized access to one or more employee email accounts. This is not ransomware. No threat actor has been publicly identified.

What was stolen

Per CommuniCare’s notice:

Full name
Date of birth
Health insurance account / member / group number
Clinical information, diagnoses, medical treatment / procedure information
Prescription information
Provider locations
Patient account numbers

The notice explicitly does not include Social Security numbers or financial account information. This narrower exposure profile reduces classic identity-theft risk but the clinical content (diagnoses, treatments, prescriptions for an FQHC population) remains significant for stigma-sensitive uses.

What CommuniCare is offering

The official notice provides vigilance guidance (account monitoring, EOB review, free credit reports, fraud alerts) but does not enroll affected individuals in complimentary credit monitoring. Some press summaries describe “free credit monitoring as a precaution,” reflecting a possible discrepancy between the formal notice text and downstream summaries.

Toll-free hotline: 1-833-289-5065 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

What to do

Watch your insurance Explanation of Benefits statements for unfamiliar claims.
Place free credit freezes at all three bureaus as a baseline precaution.
Pull a free credit report at annualcreditreport.com.
Be alert to scams referencing your specific FQHC services — exposed dataset includes enough specificity for targeted outreach.
Stop the ongoing flow of your community-health data. HealthConsent files HIPAA restriction requests so the diagnosis and treatment data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.