Team Select Data Breach 2026 (Doctor Alliance Vendor): 949 Arizona Pediatric Home Health Patients Exposed. Same Vendor as BAYADA, Amedisys, LHC Group. What To Do

What happened

Team Select Home Care is a national pediatric + adult home health and private-duty nursing provider headquartered in Phoenix, Arizona. Service mix is heavily weighted toward long-term pediatric skilled nursing — medically complex and technology-dependent children on Medicaid and CHIP — plus adult private-duty nursing. Locations span Arizona, Colorado, Florida, Illinois, Oklahoma, Pennsylvania, Texas, and others.

The 949-person Arizona-filed count likely reflects only the AZ-resident slice; total US patient count across Team Select’s footprint is much larger.

This breach did not originate at Team Select’s own systems. It originated at Doctor Alliance, LLC, a Dallas-based third-party vendor that facilitates physician signatures on Home Health Certifications and Plans of Care. The same Doctor Alliance vendor breach also affects:

• BAYADA Home Health Care
• Amedisys (Optum subsidiary)
• LHC Group (Optum subsidiary)

Between October 31 and November 17, 2025, an unauthorized actor accessed Doctor Alliance’s web portal. The ransomware / extortion actor “Kazu” posted on an underground forum on November 7, claiming 1.24M files / 353 GB stolen and demanding $200,000 ransom. Doctor Alliance discovered the incident on November 12, 2025 and notified Team Select on January 12, 2026. Team Select filed with HHS OCR on March 12, 2026 — confirming 949 affected Arizona patients.

Why a pediatric medically complex population matters

Team Select’s Arizona book is dominated by long-term pediatric medically complex cases — children on home ventilators, with feeding tubes, complex medication regimens, and 24/7 nursing care needs. Exposed clinical detail likely includes:

• Minor patients’ diagnoses, ventilator and feeding-tube specifications, medication regimens
• Parent and legal guardian contact data
• Medicaid and CHIP enrollment IDs (consistent with the disclosed “health insurance information” category, though not explicitly confirmed for the Team Select cohort)

Pediatric medical records carry long-tail synthetic-identity-theft risk that doesn’t surface for years after the breach.

What was stolen

Per the Doctor Alliance breach corpus (applicable to Team Select patients):

• Full name, home address, phone, email
• Date of birth
• Social Security number
• Driver’s license / state ID
• Financial account information
• Medicare ID
• Medical record numbers
• Primary and secondary diagnoses
• Detailed treatment plans with codes
• Safety measures, medication and dosage
• Provider names, prescription information
• Health insurance, billing, and claim data

A sample of 533 patient-file images was posted publicly by Kazu.

What Team Select is offering

Team Select’s specific offer is not confirmed in publicly indexed sources — the company’s prior domain (teamselecthh.com) is not currently reachable, and no dedicated breach notice page has been located on the current corporate site (tshc.com). Other Doctor Alliance downstream entities (BAYADA, Amedisys, LHC Group) have offered standard credit monitoring and identity-theft protection. Read your specific notification letter for activation details.

Class actions

Class actions are targeting Doctor Alliance, not Team Select directly. Active investigations and filings by Migliaccio & Rathod LLP, Barnow & Associates, and Potter Handy. A federal class action against Doctor Alliance has been filed.

What to do

1. Read your specific notification letter to confirm what data elements were involved and what credit monitoring is offered.
2. Enroll in any monitoring offered.
3. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN, driver’s license, and financial accounts are in scope.
4. File IRS Form 14039.
5. If your child was a Team Select patient, freeze their credit at all three bureaus (minors require manual outreach with proof of guardianship). Pediatric medically complex records create exceptionally long-tail synthetic-identity-theft risk.
6. Watch your Medicare or Medicaid Summary Notice for unfamiliar home-health claims.
7. Stop the ongoing flow of your pediatric home-health data. HealthConsent files HIPAA restriction requests across pediatric home-health, durable medical equipment, and prescription networks.

Continue reading

• Your eight HIPAA rights, in plain English
• BAYADA Home Health Care Data Breach 2026 (Doctor Alliance victim)
• Amedisys Data Breach 2026 (Doctor Alliance victim)
• LHC Group Data Breach 2026 (Doctor Alliance victim)
• Other 2026 healthcare data breaches