How do I know if I am affected by the LifeSpring Home Care data breach?

LifeSpring Home Care is mailing notification letters directly to affected individuals. If you have received care or services from LifeSpring Home Care (also operating as LifeSpring In-Home Care Network LLC) in the period leading up to April 2026 and you have not received a letter, contact the entity directly. 7,509 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the LifeSpring Home Care breach?

According to the notification letter and supporting filings, the compromised data included: Full name (specific PHI categories not publicly enumerated), Likely demographic and clinical information typical of home-health BAs.

Was LifeSpring Home Care attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the LifeSpring Home Care breach. The incident is categorized in the HHS OCR portal as a hacking.

Should I file a lawsuit over the LifeSpring Home Care data breach?

1 plaintiffs' firms have publicly announced investigations or filed complaints related to the LifeSpring Home Care breach: Shamis & Gentile (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

What is HealthConsent and how does it help with the LifeSpring Home Care breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by LifeSpring Home Care addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Norman, OK Disclosed April 6, 2026

LifeSpring Home Care Data Breach 2026: 7,509 Oklahoma Home-Health Patients Exposed. What To Do

LifeSpring In-Home Care Network LLC, an Oklahoma home health, hospice, and personal-care provider, disclosed in April 2026 a network intrusion exposing patient data for 7,509 individuals. Patient base skews elderly, disabled, and medically fragile. Limited public detail. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jan 1, 2026

Attacker gained access

Jan 1, 2026

Breach detected

Apr 6, 2026

Filed with HHS OCR

Jan 1, 2026

Attacker gained access

Jan 1, 2026

Breach detected

Apr 6, 2026

Filed with HHS OCR

Data exposed

Health records

Don't expire and can't be reissued

Likely demographic and clinical information typical of home-health BAs

Contact & insurance

Phishing + targeted scams

Full name (specific PHI categories not publicly enumerated)

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Shamis & Gentile (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

LifeSpring In-Home Care Network LLC is an Oklahoma home-based-care provider founded in 2003, headquartered at 2411 Springer Drive, Norman, OK. Services include home health, hospice, and personal care. The patient population skews elderly, disabled, and medically fragile — a classically vulnerable demographic for whom secondary identity-theft harms compound underlying frailty.

LifeSpring filed with HHS OCR on April 6, 2026 confirming 7,509 affected individuals, classified as a Hacking/IT Incident. Specific discovery and intrusion-window dates have not been publicly disclosed. No ransomware group has been publicly identified, and no leak-site listing has surfaced.

(Note: aggregator sources sometimes conflate this incident with the unrelated 2023-2024 Carespring Healthcare Management ransomware breach — different entity, different state.)

What was exposed

No public source has enumerated the specific PHI categories from LifeSpring’s actual notification letter. Industry aggregator pages list generic home-health-BA categories (names, SSNs, DOB, addresses, government IDs, medical info, financial info) but these are inferred rather than confirmed by LifeSpring’s notice.

If you receive a LifeSpring notification letter, the letter itself will list the specific data elements involved in your case.

What LifeSpring is offering

No specific credit-monitoring vendor or duration has been disclosed in available public reporting. Two inquiry phone lines have been published:

1-303-338-4545 (Castle Rock, CO breach-response call center)
1-800-218-1059 (TTY 711, Monday to Friday)

What to do

Read your specific notification letter carefully for enrollment details on any offered credit monitoring.
Place free credit freezes at all three bureaus as a baseline precaution.
If you are a family member or guardian of a LifeSpring home-health patient (elderly, disabled, medically vulnerable), monitor their accounts and statements on their behalf.
Stop the ongoing flow of your home-health data. HealthConsent files HIPAA restriction requests across home-health and prescription networks.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.