HealthConsent
Active breach tracker Hatillo, Puerto Rico Disclosed March 26, 2026

Hatimedik (Corporación de Servicios Médicos de Hatillo) Data Breach 2026: 24,236 Puerto Rico Community Health Patients Exposed. What To Do

Hatimedik, the Hatillo, Puerto Rico Federally Qualified Health Center serving roughly 19,000 patients across 10 service sites in north-central PR, disclosed in March 2026 a cybersecurity incident affecting 24,236 individuals. The public notice did not enumerate specific data categories or offer credit monitoring. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Jan 15, 2026

Unauthorized network access (approximate, inferred from OCR timing)

Jan 15, 2026

Breach detected

Mar 26, 2026

Filed with HHS OCR; substitute notice posted

Data exposed

03

Contact & insurance

Phishing + targeted scams

Patient information (specific categories not enumerated in public notice)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Corporación de Servicios Médicos Primarios y Prevención de Hatillo (operating as Hatimedik) is a Federally Qualified Health Center / Centro 330 grantee based in Hatillo, Puerto Rico. Hatimedik serves approximately 19,369 patients across 10 service sites spanning Hatillo, Arecibo, Utuado, and Aguadilla in north-central and northwest Puerto Rico. The patient population is largely low-income: 96.5% at or below 200% of the federal poverty line, 62.4% Medicaid/CHIP, and 9.4% uninsured.

On March 26, 2026, Hatimedik filed with HHS OCR, confirming 24,236 affected individuals. The substitute notice (posted in both Spanish and English at csmpr.org) describes the event as “recientemente identificamos un incidente de ciberseguridad que implicó un acceso no autorizado a ciertos sistemas y datos” / “we recently identified a cybersecurity incident involving unauthorized access to certain systems and data.” Specific discovery and access-window dates are not stated publicly.

No threat actor has been named. No leak-site listing tied to Hatimedik has surfaced. Operations were not interrupted, per the entity notice.

What was exposed

The entity notice describes only “ciertos sistemas y datos” / “certain systems and data” without enumerating data categories. As a full-service FQHC handling primary care, pharmacy, and mobile clinic services, affected records likely span demographic identifiers, Medicaid IDs, and clinical data, but Hatimedik has not publicly confirmed which data elements were involved. Affected individuals will receive individual notification letters with the specific data categories applicable to their records.

What Hatimedik is offering

The public substitute notice does not mention complimentary credit monitoring or identity theft protection enrollment. Hatimedik has confirmed it engaged cybersecurity experts and notified authorities.

What to do

  1. Place a free credit freeze at Equifax, Experian, and TransUnion as a baseline precaution while waiting for your specific notification letter to clarify exposure.
  2. Pull a free credit report at annualcreditreport.com.
  3. Watch your insurance Explanation of Benefits statements (or your Medicaid summaries) for unfamiliar claims.
  4. Email Hatimedik at [email protected] if you have received Hatimedik care and have not received a notification letter — request your specific exposure details.
  5. Exercise Puerto Rico Law 111-2005 (Information Security Act) rights. Affected individuals are entitled to specific notifications and protections under PR’s data-breach statute.
  6. Stop the ongoing flow of your healthcare data. HealthConsent files HIPAA restriction requests so the demographic and treatment-context data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.