Consultants in Pain Medicine Data Breach 2025: 1,124 Affected · Hacking/IT Incident · TX. Filed With HHS OCR. What To Do.

Consultants in Pain Medicine, a San Antonio, Texas pain management practice, disclosed that an unauthorized third party accessed its network between June 26 and July 7, 2024, and that the data of 1,124 individuals was exposed. The practice filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on February 16, 2025, classified as a Hacking/IT Incident at a network server, and notified the Texas Attorney General two days later.

Timeline

• June 26 – July 7, 2024 — Unauthorized third party accessed Consultants in Pain Medicine’s network and certain files containing patient information.
• January 17, 2025 — CPM completed its review of the affected data and identified the individuals whose information was involved.
• February 14, 2025 — Notification letters began mailing to affected patients; a substitute notice was also posted to the practice’s website.
• February 16, 2025 — HIPAA breach report filed with the HHS Office for Civil Rights (1,124 individuals; Hacking/IT Incident; Network Server).
• February 18, 2025 — Notice of data breach filed with the Texas Attorney General.

What was exposed

According to the notice and subsequent counsel write-ups, the exposed data elements include:

• Names
• Social Security numbers
• Dates of birth
• Driver’s license numbers and state identification numbers
• Passport numbers
• Financial account numbers
• Medical information
• Health insurance policy information

Affected individuals whose Social Security numbers were involved were offered complimentary credit monitoring and identity theft protection services.

Why this one is unusually sensitive

Pain medicine practice records are not just “health data.” A pain-management chart typically documents controlled-substance prescribing history, opioid dosing, urine drug screen results, and in many cases a buprenorphine, methadone, or other substance-use-disorder treatment course. That category of record is governed by 42 CFR Part 2 in addition to HIPAA, and it carries real-world consequences if it leaks: employment discrimination, custody disputes, insurance underwriting friction, and stigma in any future medical encounter. A breach that pairs a name and Social Security number with the fact that someone is a chronic-pain or SUD-adjacent patient is materially worse than a breach of the same identifiers from a general-practice clinic.

Credit monitoring offering

Individuals whose Social Security numbers were involved were offered complimentary credit monitoring and identity theft protection services through CPM’s notification letter. The notification letter is the document of record; enrollment instructions and the activation code are inside it.

Class action status

As of this update, no consolidated class action complaint has been publicly docketed. Multiple plaintiffs’ firms — including Strauss Borrelli PLLC and Console & Associates, P.C. — have announced active investigations and are soliciting affected individuals. Investigation announcements are not lawsuits; they signal that firms are gathering named plaintiffs and assessing damages theories before any complaint is filed.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against identity theft when Social Security numbers are involved.
• Enroll in the offered credit monitoring if you received a letter. The activation code is single-use and tied to your record.
• Watch for medical-identity-theft signals, not just financial ones: explanation-of-benefits statements for care you did not receive, prescription denials at the pharmacy because a refill was already filled, or a new provider’s intake showing prescriptions you did not get. These are the patterns that show up after a pain-clinic breach.
• If you were in active treatment, ask CPM’s records custodian directly whether your specific chart (including controlled-substance prescribing history) was among the files accessed. The HHS portal entry covers the population; only your individual notice covers you.
• Keep your notification letter. It is the document that establishes standing if a class action is later filed and certified.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Console & Associates, P.C. on JDSupra — confirms SSNs and other identifiers were involved; details the access window.
• Strauss Borrelli PLLC investigation — class-action plaintiffs’ firm investigation page with the data-element list and notification date.
• Console & Associates — investigation page — corroborating data-element list and notification timeline.
• Data Breach Class Action — investigation — additional confirmation of access window and exposed-data categories.