Marion County Public Health Data Breach 2026: 792 Indianapolis Lab Clients Exposed by Insider Snooping. What To Do

What happened

The Health and Hospital Corporation of Marion County (HHC) is the municipal health authority for Marion County, Indiana (Indianapolis). HHC operates Eskenazi Health, the Marion County Public Health Department (MCPHD), and the Long Term Care Division.

This incident affected the MCPHD clinical lab specifically — Eskenazi Health and the Long Term Care Division are not implicated.

On January 25, 2026, HHC’s internal monitoring detected that an MCPHD lab employee had accessed records of 792 lab clients beyond what their job duties required. This is a textbook HIPAA Minimum Necessary Rule violation — internal employee snooping, not hacking or an external attack.

HHC publicly disclosed the incident, mailed notification letters, and filed with HHS OCR on January 30, 2026 — a 5-day turnaround from discovery, unusually fast and consistent with a clean insider-snooping fact pattern that didn’t require lengthy forensic investigation.

The specific lab program is not publicly disclosed. The MCPHD lab handles STI testing, TB screening, and water and food safety testing. Employment status of the snooping employee was also not publicly disclosed.

What was exposed

Per HHC’s notice:

• Full name
• Email address
• Date of birth
• Lab results

Explicitly NOT in scope: Social Security number, financial information, insurance and payment data.

The exposure is genuinely sensitive — lab results from a public health department lab can reveal STI status, TB exposure, or other stigmatizing health information depending on which program the affected clients tested through. But the absence of SSN and financial data materially limits identity-theft risk.

What HHC is offering

• Strengthened technical safeguards (access limited to minimum necessary)
• Retraining on the HIPAA Minimum Necessary Rule
• Mail notification to affected clients

No public mention of credit monitoring, identity protection, or a dedicated call center. Given the PHI categories in scope (no SSN, no financial), credit monitoring would not address the actual harm — this is consistent with how regulators view similar low-financial-risk insider incidents.

Lab-results exposure is the real concern

If you were notified about this incident:

• Your email address + DOB combination is enough to enable targeted phishing referencing your specific lab visit. Be alert.
• If your lab visit was for STI testing (one of MCPHD’s lab programs), recognize that the employee who accessed your records knows your test result. While no class action is currently filed, you may want to document this for potential individual claims.
• TB testing or food/water safety lab visits are less sensitive but still personal.

What to do

1. Read your specific notification letter to confirm which lab program your records were associated with.
2. Be alert to phishing emails referencing your MCPHD visit. The combination of email + DOB + clinic context is highly credible to attackers.
3. If your STI or other sensitive lab results were in scope, consider what proactive disclosures you may want to make to close contacts, regular providers, or employers depending on context.
4. Contact HHC’s compliance office (Lisa Taylor, Chief Compliance Officer) if you have specific questions about your case.
5. Stop the ongoing flow of your public-health data. HealthConsent files HIPAA restriction requests covering county public health lab and clinical pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches