Prime Care 12 Priority Health Data Breach 2026: 1,000 West Virginia Primary Care Patients Exposed. Small Rural Practice. What To Do

What happened

Prime-Care 12 Priority Health, Inc. is a small independent family practice / primary care clinic at 702 Stafford Drive in Princeton, West Virginia (Mercer County, southern WV coal country). The practice is staffed by two nurse practitioners — Shawn L. Vest, FNP and Kristin Youther, FNP — and offers family practice, DOT physicals, sports physicals, and urgent same-day appointments. Operating hours are Monday to Thursday 7:30 a.m. to 5 p.m. and Friday 7:30 a.m. to noon, consistent with a very small rural practice.

Despite the legal name “Priority Health” in the title, this entity is not an MCO or health plan — it is a two-NP primary care clinic. The NPI is 1306569868.

Prime Care 12 filed with HHS OCR on April 20, 2026 — confirming 1,000 affected individuals. The 1,000 count is consistent with a two-NP practice’s entire active patient panel — likely most or all of the practice’s patients in rural Mercer County.

No ransomware group has publicly claimed responsibility. Given the practice’s small profile (two NPs, a Yahoo email contact, a Wix-hosted brochure website), the attack was almost certainly opportunistic — not a targeted exfiltration by a major ransomware-as-a-service group.

Why this page is sparse

As of mid-May 2026, no notification letter has been posted on primecare12ph.com. No HIPAA Journal, DataBreaches.net, Charleston Gazette-Mail, or West Virginia MetroNews coverage has surfaced. West Virginia has no general AG breach portal database. Multi-state AG filings have not surfaced because the affected population is likely almost entirely WV residents in Mercer County (below most multi-state notification thresholds).

The clinic has not published a public substitute notice. The absence of an entity-issued web notice 25 days post-OCR filing is itself a compliance concern.

What was potentially exposed

Per third-party aggregator (ClaimDepot) — these categories are not confirmed by a primary source notification letter:

• Full name
• Social Security number
• Date of birth
• Home address
• Government IDs
• Medical information
• Financial information

If you receive a Prime Care 12 notification letter, the letter will list the specific data elements involved in your case.

What to do

1. Call Prime Care 12 at 304-425-0085 and ask whether they have mailed a substitute notice and what credit monitoring (if any) is being offered.
2. Place free credit freezes at Equifax, Experian, TransUnion as a baseline precaution.
3. Pull free credit reports at annualcreditreport.com and watch for unfamiliar accounts.
4. If you are an elderly family member’s caregiver, monitor their statements on their behalf — rural primary care practices serve heavily elderly patient populations.
5. Stop the ongoing flow of your primary care records. HealthConsent files HIPAA restriction requests so the demographic and treatment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches