HealthConsent
Active breach tracker PA Disclosed August 18, 2025

Bevel Health Medical Group Data Breach 2025: 510 Affected · Unauthorized Access/Disclosure · PA. Filed With HHS OCR. What To Do.

Bevel Health Medical Group (PA) filed a HIPAA breach notification with the HHS Office for Civil Rights on August 18, 2025, reporting 510 affected individuals in a Unauthorized Access/Disclosure event at Electronic Medical Record. The HHS OCR portal entry is the primary public record; further details are not yet publ...

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Aug 18, 2025

Bevel Health Medical Group filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights, reporting 510 affected individuals in an Unauthorized Access/Disclosure event involving an Electronic Medical Record.

Data exposed

02

Health records

Don't expire and can't be reissued

Not publicly disclosed beyond 'Electronic Medical Record' on the OCR portal
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

Bevel Health Medical Group, a Pittsburgh-area addiction-medicine provider, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on August 18, 2025, reporting 510 affected individuals in an Unauthorized Access/Disclosure event involving an Electronic Medical Record. The entity is a Healthcare Provider based in Pennsylvania. The HHS OCR portal entry is the primary public record of this incident; as of this update, no substitute notice, press release, or state attorney general posting corroborating the filing has been located.

Timeline

  • August 18, 2025 — Bevel Health Medical Group filed the breach report with HHS OCR, reporting 510 affected individuals in an Unauthorized Access/Disclosure event at an Electronic Medical Record.

We update each page as the entity’s own notification letter, state attorney general filings, established trade press, or court filings become available.

What information was exposed

Per the HHS OCR portal, the breached information was located in an Electronic Medical Record. The OCR portal does not enumerate the specific data elements (for example, names, dates of birth, Social Security numbers, diagnosis codes, treatment notes, insurance identifiers) involved in this filing. Because Bevel Health Medical Group is an addiction-medicine practice, records held in its EMR may include information protected under both HIPAA and 42 CFR Part 2 (federal substance-use-disorder confidentiality rules); however, the OCR HIPAA-portal entry does not indicate whether this filing was also made under Part 2. Specific data-element disclosures should appear in the entity’s individual notification letters or any substitute notice.

Credit monitoring or identity-protection offering

No credit-monitoring or identity-protection offering has been publicly announced in connection with this filing. If you receive a notification letter from Bevel Health Medical Group, read it carefully — any complimentary monitoring, the enrollment deadline, and the activation code will be listed there.

Class-action status

No class-action lawsuit related to this breach has been identified in public court records as of this update.

What to do if you may be affected

Until the entity publishes a substitute notice or your individual notification letter arrives, the protective steps to take are generic but useful:

  • Freeze your credit with the three nationwide consumer reporting agencies. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against identity theft.
  • Watch for a notification letter at the address on file with Bevel Health Medical Group. Notification letters typically follow the OCR filing by a few weeks. Read it carefully. It will list the specific data elements exposed and any complimentary credit-monitoring offered.
  • If you are a current or former Bevel Health patient receiving substance-use-disorder treatment, be aware that records of that treatment carry additional federal confidentiality protections under 42 CFR Part 2. You can ask the entity in writing what categories of records were involved and whether the filing was also made under Part 2.
  • Report identity-theft concerns to the Pennsylvania Office of Attorney General if you are a Pennsylvania resident.
  • Bookmark this page. We update it as new information becomes publicly available.

Sources on this page

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.