Metrocare Services Data Breach 2026 (March Filing — Second Incident): 602 Dallas Behavioral Health Clients Exposed. Lost Portable Device + Email. What To Do

What happened

Dallas County Mental Health Mental Retardation Center, doing business as Metrocare Services, is Dallas County’s designated Local Mental Health Authority (LMHA) and Local IDD Authority (LIDDA). It is the largest community mental health provider in North Texas, serving tens of thousands of low-income adults and children with serious mental illness, intellectual / developmental disability (IDD), and substance use disorder (SUD) comorbidity. The patient population is uniquely vulnerable: Medicaid recipients, court-ordered clients, foster youth, homeless adults, and veterans.

Metrocare filed an HHS OCR breach on March 6, 2026 for 602 individuals — Unauthorized Access/Disclosure at Email AND Other Portable Electronic Device (an unusual dual-location classification). Incident discovery likely occurred between January and early March 2026 (per HIPAA’s 60-day rule).

This is Metrocare’s second reportable OCR breach in approximately 5 months — following an October 2025 incident affecting 8,599 individuals (an employee forwarded encrypted email to a personal address). Cole & Van Note opened a class action investigation on that earlier incident.

Why this page is sparse

As of mid-May 2026, Metrocare has not posted a public notice for the 602-individual March filing:

• The entity’s community-notice page still shows only the 2020 incident
• The press-release page’s latest item is the November 2025 notice for the prior 8,599-individual incident
• No Dallas Morning News, Texas Tribune, KERA, or NBC 5 DFW coverage of this specific filing
• HIPAA Journal’s March 2026 report does not list it
• No Texas, California, Maine, or Massachusetts AG notification located

A separate Metrocare board leadership transition and interim CEO appointment was announced in April 2026 — possibly coincidental, possibly governance fallout from compounding breach exposure.

Likely cause

The dual “Email + Other Portable Electronic Device” classification is unusual and likely reflects:

1. Lost or stolen device with cached email (phone, tablet, or laptop with synced mailbox containing PHI) — fits both location tags simultaneously
2. PHI emailed to a portable device that was subsequently lost or compromised

The 602-person scale suggests a single caseload-sized export (one clinician’s panel, one program roster) rather than enterprise compromise.

The cause is not publicly confirmed — read your specific notification letter for details.

42 CFR Part 2 implications

Because Metrocare provides integrated co-occurring disorder programming (mental health + SUD), some affected patients’ records are likely covered by 42 CFR Part 2 — the federal regulation governing substance use treatment records, which imposes stricter consent and re-disclosure requirements than HIPAA. OCR began enforcing Part 2 under a unified rule effective February 16, 2026.

If your records included SUD treatment, you have a private right of action for unauthorized re-disclosure beyond what HIPAA alone provides.

What was potentially exposed

Specific PHI categories have not been publicly disclosed. Given Metrocare’s record types, likely categories include:

• Full name, date of birth
• Medical record number
• Mental health diagnosis codes
• IDD diagnoses
• Medication and treatment history
• Appointment data
• Payer information (Medicaid IDs likely)

Read your specific notification letter for the confirmed data elements.

What Metrocare is offering

Not publicly disclosed. No notice letter is available online; credit monitoring vendor, duration, and call center information are unknown.

What to do

1. Call Metrocare’s main line (214-743-1200) and ask whether you have been notified about the March 2026 incident and what response is being offered.
2. Read your specific notification letter to confirm what data elements were involved and what monitoring is offered.
3. Place free credit freezes at Equifax, Experian, TransUnion if any of your identifying data was in scope.
4. If your SUD treatment records were in scope, document the breach — 42 CFR Part 2 gives you stronger private remedies than HIPAA for unauthorized re-disclosure.
5. If you are a Medicaid recipient, monitor your Medicaid Summary Notices for unfamiliar claims.
6. Stop the ongoing flow of your behavioral health data. HealthConsent files HIPAA and Part 2 restriction requests so the mental health, SUD, and IDD treatment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches