Clinic Service Corporation Data Breach 2026: 82,331 Colorado Patients Exposed via Medical-Billing Vendor. 12 Months Cyberscout Monitoring. What To Do

What happened

Clinic Service Corporation (CSC) is a medical-billing, revenue-cycle-management, and practice-management consultancy founded in 1974 and headquartered in Denver, Colorado. It describes itself as “Colorado’s largest independent medical billing firm.” CSC operates as a HIPAA business associate to many small and mid-sized Colorado practices. Confirmed client examples include Denver Pain Management, Elk Ridge Family Physicians, Comprehensive Anesthesia of Greenwood Village, and Scholes Dermatology.

Between August 10 and August 17, 2025, an unauthorized third party accessed CSC’s network. CSC detected the activity on August 17 and cut off the unauthorized access. On October 17, 2025, CSC posted a substitute notice to its website. Individual notification letters were mailed beginning January 27, 2026 (via Cyberscout / TransUnion mail house). CSC filed with HHS OCR and the Massachusetts Attorney General on January 28, 2026 (filing 2026-128), confirming 82,331 affected individuals (15 MA residents disclosed).

Because CSC handles end-to-end revenue cycle data for many unrelated client practices, the breach blast radius spans multiple unrelated provider patient rosters — which is why a small consultancy (~10 employees) landed at 82,331 affected.

No ransomware group has claimed responsibility. The earlier HIPAA Journal article bundled coverage of CSC with Insightin Health (Medusa attribution); that attribution applies to Insightin Health, not CSC.

What was stolen

The compromised data includes:

• Full name, home address, phone number, email address
• Date of birth
• Payment card information
• Patient ID number
• Medical record number
• Medicare / Medicaid number
• Diagnoses
• Treatment information
• Dates of service
• Health insurance information (claim and policy numbers)
• Treatment cost information

Federman & Sherwood’s investigation page also references Social Security numbers; the public Massachusetts notice excerpt does not explicitly confirm SSN, so confidence on SSN inclusion is medium.

What CSC is offering

• Complimentary credit monitoring and identity protection through Cyberscout (a TransUnion company)
• Duration referenced as at least 12 months
• Dedicated call center: 1-833-580-0434

What to do

1. Enroll in Cyberscout through the link in your notification letter.
2. Cancel and reissue any payment cards used for billing through CSC client practices since 2020.
3. Place free credit freezes at all three bureaus.
4. Watch your insurance Explanation of Benefits for unfamiliar claims.
5. Stop the ongoing flow of your billing and treatment data. HealthConsent files HIPAA restriction requests across providers, insurers, and prescription networks.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches