Renovo Chiropractic & Wellness Data Breach 2026: 538 Washington Patients Exposed via Off-Site Storage Break-In. Paper EOBs Stolen. What To Do

What happened

Renovo Chiropractic & Wellness LLC is a small single-location chiropractic and wellness practice at 914 D Street NE, Suite 101, Auburn, Washington (King County, south of Seattle). The practice focuses on “structural correction” chiropractic, plus spinal decompression, laser therapy, cryotherapy, rehabilitation, and motor vehicle accident / workers’ comp injury care.

On January 16, 2026, there was a physical break-in at an off-site archived storage facility used by the practice (not the main clinic). The break-in was discovered the same day. Items taken were approximately three years of paper Explanation of Benefits (EOB) documents covering patients seen from January 1, 2021 through December 31, 2024.

Renovo mailed patient notification letters on March 10, 2026 — 53 days after discovery, within HIPAA’s 60-day notification window. The HHS OCR breach portal submission followed on March 16, 2026 — confirming 538 affected individuals.

No electronic devices, backup media, or vehicle theft was involved — this was a physical document theft from a storage facility.

What was stolen

Per the entity’s disclosure letter, the stolen EOBs contained:

• Patient names
• Insurance ID numbers
• Diagnosis codes

Renovo explicitly states the documents did NOT include:

• Social Security numbers
• Phone numbers
• Email addresses
• Financial account information
• Other private contact information

The exposure is clinical and insurance — diagnosis codes paired with insurance ID numbers. This is enough information to discriminate or commit insurance-side identity theft (filing fraudulent claims under the victim’s insurance ID), but not enough for typical financial identity theft.

What Renovo Chiropractic is offering

Renovo’s response is notably thin by 2026 standards:

• No credit monitoring offered
• No identity-theft protection offered
• No dedicated call center beyond the (253) 939-1942 info line
• Mitigation guidance: “Review any EOB statements or insurance statements you receive” and contact your insurer if unrecognized services appear
• Reported to law enforcement; notified insurance carrier

This response is likely defensible given the absence of SSN or financial data, but represents the floor of what HIPAA permits.

What to do

1. Read your specific notification letter to confirm what records were stolen.
2. Watch your insurance Explanation of Benefits statements very carefully for unfamiliar chiropractic, imaging, or related claims that you did not authorize.
3. Contact your health insurer’s fraud line to flag your account for unusual activity — insurance-side identity theft (fraudulent claims using your ID) is the primary risk here.
4. If you see unfamiliar claims, dispute them with your insurer and request a corrected medical record.
5. Stop the ongoing flow of your chiropractic claims data. HealthConsent files HIPAA restriction requests so the diagnosis-code and insurance-ID data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches