Patriot At Home / Supportive Home Health Data Breach 2026: 1,415 Ohio Home Health Patients Exposed via Email Compromise. What To Do

What happened

Superior Care Plus LLC, doing business as Supportive Home Health LLC, is affiliated with Patriot Outpatient LLC and operates publicly as Patriot At Home. It is a veteran-owned, CHAP-accredited, Medicare-certified home health agency headquartered in Girard, Ohio. Service footprint includes Greater Akron, Greater Cincinnati, and Mahoning, Trumbull, and Columbiana counties (Youngstown and Warren area). Services include skilled nursing, physical/occupational/speech therapy, social work, home health aide, hospice, and primary care.

The patient population is primarily elderly Medicare-certified individuals receiving in-home care.

On November 17, 2025, Patriot At Home detected suspicious activity on an employee email account. The forensic investigation concluded on January 9, 2026, confirming unauthorized access to specific emails and files. Patriot At Home filed with HHS OCR, posted a substitute notice, and mailed individual letters on January 16, 2026 — confirming 1,415 affected individuals.

The 60-day gap from detection to disclosure is right at HIPAA’s outer limit.

The vector is business email compromise — phishing-driven access to a single mailbox, with no ransomware indicators and no exfiltration tool identified in public disclosures.

What was stolen

Per the substitute notice:

• First and last name, city and ZIP, email address
• Health insurance policy number, policy name
• Medical treatment information
• Admission / discharge dates, patient logs
• Referring facility, start-of-care date
• Referring PCP name

A limited number of individuals also had Social Security number and/or Medicare number exposed.

Medicaid IDs and OASIS assessment data are not specifically called out in the public notice (they may fall under “medical treatment information” or “patient logs” but this is unconfirmed).

What Patriot At Home is offering

• Password reset on the impacted account; third-party cybersecurity forensics engaged
• Toll-free helpline: 1-888-572-7322 (Monday to Friday, 8:00 a.m. to 4:30 p.m. Eastern)
• Individual mailed notification letters

Credit monitoring or identity theft protection is not mentioned in any public source reviewed, which is notable given the limited SSN and Medicare-number exposure. The full PDF notice may contain offer details that are not in the public summary — read your specific letter carefully.

What to do

1. Read your specific notification letter to confirm whether your SSN or Medicare number was in the affected subset.
2. If your SSN was in scope, place free credit freezes at Equifax, Experian, TransUnion.
3. If your Medicare number was in scope, request a new Medicare Beneficiary Identifier (MBI) from Medicare (1-800-MEDICARE).
4. File IRS Form 14039 if SSN exposed.
5. Watch your Medicare Summary Notice for unfamiliar home-health claims.
6. If you are a family member or guardian of a Patriot At Home patient, monitor their statements on their behalf.
7. Stop the ongoing flow of your home-health and hospice data. HealthConsent files HIPAA restriction requests across home-health, hospice, and prescription networks.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches