Nephrology Associates Medical Group Data Breach 2026: 4,631 California Kidney Patients Exposed. No Credit Monitoring Offered. What To Do

What happened

Nephrology Associates Medical Group (NAMG) is a long-established (40+ years) California nephrology practice serving the Inland Empire (Riverside and San Bernardino counties) and the Coachella Valley. NAMG operates 16 offices plus a dialysis center and hospital network, treating chronic kidney disease (CKD), end-stage renal disease / dialysis, kidney transplant, and kidney stones.

On May 20, 2025, NAMG detected suspicious activity on its network and engaged a third-party forensic investigator. The investigation concluded on December 2, 2025, confirming PHI exposure. NAMG dated its public notice February 25, 2026 and issued a press release / mailed individual notification letters on February 27, 2026 — confirming 4,631 affected individuals.

The entry vector was a compromised employee email account. Forensics found broader network access and file exfiltration; the email account was the initial foothold. No ransomware group has publicly claimed responsibility. No leak-site listing has been observed.

Notable timing concerns:

• 6+ month dwell time between detection (May 2025) and confirmation (December 2025).
• 9+ month notification lag between intrusion and patient notice — exceeds typical HIPAA Breach Notification Rule expectations (60 days from discovery).

What was stolen

Per NAMG’s notice:

• Full name
• Social Security number
• Date of birth
• Medical / health information
• Treatment / diagnostic information
• Health insurance information
• Billing / payment information
• Credentialing information (suggests provider/staff records may also be in scope)

What NAMG is offering

NAMG’s notice does not offer complimentary credit monitoring or identity theft protection. This is unusual for a breach with full SSN exposure and is likely to be a focal point of any class action.

• Toll-free call center: (844) 443-1521 (Monday to Friday, 6:30 a.m. to 3:30 p.m. Pacific)
• Security uplift: stronger passwords, forced rotation, reduced access permissions, offline storage of legacy data

What to do

1. Place free credit freezes at Equifax, Experian, TransUnion. NAMG is not providing monitoring.
2. File IRS Form 14039 (Identity Theft Affidavit). Full SSN is in scope.
3. Consider purchasing your own credit monitoring given the SSN + DOB + medical + billing exposure profile.
4. Cancel and reissue any payment cards that may be tied to billing/payment information.
5. Watch your Medicare Summary Notice for unfamiliar dialysis or nephrology claims.
6. Stop the ongoing flow of your kidney-care data. HealthConsent files HIPAA restriction requests so the dialysis, lab, and transplant data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• California CMIA: stronger protections than federal HIPAA
• Other 2026 healthcare data breaches