Integrated Pain Associates Data Breach 2026: 500+ Texas Pain Management Patients Exposed Across 7 Locations. Controlled-Substance Records in Scope. What To Do

What happened

Integrated Pain Associates (IPA) is a Texas interventional pain management practice headquartered at 3800 SWS Young Drive, Suite 301, Killeen, TX. The practice operates seven Texas locations across Central and West Texas: Killeen, Abilene, Waco, Lampasas, Temple, Odessa, and Brownwood.

On February 24, 2026, an unauthorized actor accessed IPA’s network. The forensic review concluded on April 30, 2026, and IPA posted a data incident notice the same day. HHS OCR filing followed on May 1, 2026 — initial placeholder of 500 affected individuals (final count is likely higher given the 7-location footprint).

The ~65-day gap from access to disclosure is consistent with HIPAA’s 60-day notification clock running from the forensic conclusion rather than from the initial intrusion date.

No ransomware group has publicly claimed responsibility. No dark-web leak-site listing has been observed.

Why pain-management breaches carry hidden risk

IPA is a controlled-substance-prescribing specialty under DEA scrutiny. Opioid and controlled-substance prescription history is among the most stigmatizing categories of PHI, with consequences for:

• Employment background checks
• Insurance underwriting
• Professional licensing
• Child custody disputes
• Ongoing DEA prescribing-pattern surveillance

If your records include opioid or controlled-substance therapy, even partial disclosure can have outsized professional and personal consequences.

Fort Cavazos / military beneficiary impact: IPA’s Killeen location is adjacent to Fort Cavazos (formerly Fort Hood). TRICARE patients and military families in the region may be affected, which could trigger separate DoD notification requirements.

What was stolen

Per the entity’s data incident notice:

• Full name, home address, date of birth
• Driver’s license number
• Social Security number
• Diagnosis / condition information
• Medication information (controlled-substance Rx history implied given pain-management specialty)
• Provider name
• Other treatment information
• Health insurance information
• Financial account information

The combination of SSN + driver’s license + financial accounts + controlled-substance records is a particularly high-stakes exposure.

What IPA is offering

• Complimentary credit monitoring and identity theft protection (vendor and duration not publicly disclosed)
• Dedicated call center: 1-800-405-6108 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)
• Forensic specialists engaged; law enforcement notified; additional security measures deployed

What to do

1. Read your specific notification letter to confirm the data elements involved and the credit monitoring terms offered.
2. Enroll in the offered monitoring through the activation code in your letter.
3. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN, driver’s license, and financial accounts are in scope.
4. File IRS Form 14039.
5. Cancel and reissue payment methods tied to financial accounts.
6. Replace your driver’s license if you receive evidence of identity theft using it.
7. If your prescription history matters professionally (employment background, custody, professional licensing, DEA scrutiny), document the breach for future disputes.
8. If you are a TRICARE / military beneficiary treated at the Killeen location, separately contact your TRICARE region administrator about secondary protections.
9. Stop the ongoing flow of your pain management records. HealthConsent files HIPAA restriction requests covering controlled-substance prescription pathways including PDMPs, PBMs, and insurance networks.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches