University of Iowa Health Care Data Breach 2025: 101,875 Affected · UI Community HomeCare Network Intrusion · Class Actions Filed

University of Iowa Health Care filed a HIPAA breach notification with HHS OCR on August 29, 2025 reporting 101,875 affected individuals in a Hacking/IT Incident at a Network Server. This filing is the UIHC half of a single intrusion: on the same day, the system’s home-infusion and home-medical-equipment affiliate filed a separate report for 109,029 individuals as University of Iowa Community Home Care. The combined population — which UIHC describes publicly as “approximately 211,000” — reflects the two covered entities sharing some patients, employees, and data files even though they operate distinct EHR and IT systems.

Timeline

• July 3, 2025 — Access and detection. An unauthorized actor accessed UI Community HomeCare’s computer systems. UIHC says the intrusion was identified the same day; servers were shut down, an outside cybersecurity firm was retained, and systems were restored within one business day. UIHC’s own electronic health record system was not breached, but file repositories shared with the affiliate were within scope.
• August 29, 2025 — Notification. UI Health Care mailed individual notification letters and filed paired HHS OCR breach reports — one for UIHC (101,875) and one for UI Community Home Care (109,029). UIHC’s substitute notice was published the same day at uihc.org.
• Mid-September 2025 — Litigation. Within roughly two weeks of notice, at least eight putative class actions had been filed naming UIHC, UI Community HomeCare, and UI Community Medical Services as defendants. On September 17, 2025, counsel formally moved to consolidate all eight actions and seek appointment of co-lead attorneys, citing that each action arises from the same incident.
• November 11, 2025 — Investigation closed. ClassAction.org updated its tracker to note that its investigation into the UI Community HomeCare breach was complete.

What was exposed

Per UIHC’s own substitute notice, the files accessed during the intrusion contained patient information that varied by individual and may have included:

• Name, date of birth, address, phone number
• Medical record number, provider name, type of visit, date(s) of service
• Health insurance information

There is an important distinction between the two OCR filings. UIHC’s public FAQ at uihc.org states: “We have no indication that Social Security numbers were included in the files that were compromised” — that statement applies to the UIHC-side files. The UI Community HomeCare notification letter (reproduced in the uihealthcare.org press release) uses broader language and lists SSN as a data element that “may have been seen and taken.” Several plaintiff-firm investigation pages and state-AG-filing aggregators confirm SSN as exposed for the combined population. If your notification letter came from UI Community HomeCare rather than directly from UIHC, treat SSN as potentially in scope and act accordingly. The UIHC FAQ is the controlling source for the UIHC-specific population.

UI Community HomeCare serves individuals in Iowa, western Illinois, and northern Missouri. The organization filed breach notifications with at least 13 state attorneys general, including California, Iowa, Maine, Massachusetts, Montana, Nebraska, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, Vermont, and Washington.

What UIHC is offering

UIHC is not offering complimentary credit-monitoring or identity-theft protection in connection with this incident, citing no indication that the accessed information has been misused. The substitute notice instead directs recipients to:

• Place a fraud alert (one-year or seven-year extended) or a credit freeze with the three nationwide credit bureaus.
• Pull free annual credit reports through annualcreditreport.com.
• Call the UI Health Care toll-free helpline at 833-745-0871, Monday through Friday, 8 a.m. to 8 p.m. Central.

Class-action posture

At least eight putative class actions have been filed in Iowa over this incident, naming University of Iowa Health Care, UI Community HomeCare, and UI Community Medical Services as defendants. Core allegations track typical hospital data-breach pleadings: negligence, breach of implied contract or fiduciary duty, and unjust enrichment, with particular emphasis on the gap between July 3, 2025 detection and August 29, 2025 notice. On September 17, 2025, counsel moved to consolidate all eight related actions and requested appointment of co-lead attorneys. Firms publicly confirmed to be investigating or pursuing claims include Federman & Sherwood, Schubert Jonckheer & Kolbe LLP, Lynch Carpenter LLP, Morgan & Morgan, and Markovits, Stock & DeMarco, LLC. ClassAction.org noted its own investigation was complete as of November 11, 2025.

It is worth noting that UI Community HomeCare experienced a prior data breach in 2023 (detected March 23, 2023, affecting 67,897 individuals), for which Markovits, Stock & DeMarco also investigated claims. The recurrence of security incidents at this affiliate strengthens negligence arguments in the 2025 litigation.

What to do

1. Check your notification letter carefully. The letter specifies whether it comes from UIHC or UI Community HomeCare. The data in scope differs: UIHC’s FAQ states no SSN on its side; the HomeCare population may include SSN. Your individual letter controls.
2. Freeze your credit with Equifax, Experian, and TransUnion. It is free, reversible, and the single highest-leverage step against new-account fraud. This is especially important here because UIHC is not providing complimentary monitoring.
3. File IRS Form 14039 if your notification letter confirms SSN exposure. This flags your account for added scrutiny against fraudulent tax refunds. Contact: 1-800-908-4490.
4. Watch your EOBs and patient portal. Medical-identity misuse typically appears as unfamiliar visits or claims rather than credit-card fraud. Report anomalies directly to UIHC patient billing.
5. Call the dedicated helpline. The UI Health Care toll-free number is 833-745-0871, available Monday through Friday, 8 a.m. to 8 p.m. Central.
6. Be cautious about plaintiff-firm outreach. Multiple firms are advertising for class members. You retain the right to participate in any certified class regardless of which firm contacts you first; you do not need to retain individual counsel to preserve class-member status.
7. Stop the ongoing flow of your health data. HealthConsent files HIPAA restriction requests so the treatment and insurance information exposed in this breach is not continuously re-shared across health information exchanges, payers, and affiliated health networks.

Continue reading

• Your HIPAA rights — what you can restrict and how
• University of Iowa Community Home Care Data Breach 2025 (parallel OCR filing, 109,029 individuals)
• All tracked healthcare breaches

Sources

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• UIHC official substitute notice (uihc.org) — entity’s own description of timeline, exposed data elements, and remediation guidance, including the SSN FAQ.
• UI Health Care press release (uihealthcare.org) — institutional confirmation of paired notification and sample notification letter text.
• HIPAA Journal — UI Community HomeCare Hacking Incident Affects 211,000 Patients — trade-press synthesis of the combined population.
• KCRG (CBS Cedar Rapids) — 211,000 affected — local broadcast confirmation of the joint disclosure.
• CBS2 Iowa — patient information leaked after breach at UIHC affiliate — local press confirmation of scope and affiliate relationship.
• ClassAction.org — UI Community HomeCare Data Breach lawsuit tracker — class-action filings index; investigation noted complete November 11, 2025.
• Federman & Sherwood — UIHC breach investigation — plaintiff-firm investigation naming UIHC.
• Schubert Jonckheer & Kolbe — UIHC and UI Community HomeCare investigation — names both entities; lists SSN among exposed elements for the combined population.
• Lynch Carpenter — UI Community HomeCare Data Breach Claims Investigated — additional plaintiff-firm investigation.
• Morgan & Morgan — University of Iowa Community HomeCare Data Breach — additional plaintiff-firm investigation page.
• ClaimDepot — UI Community HomeCare multi-state AG filing tracker — confirms filings with 13+ state attorneys general.
• The Gazette — Eight class-action lawsuits filed against UI Health Care, HomeCare over data breach — local press reporting on the eight suits and September 17, 2025 consolidation motion.
• The Daily Iowan — UIHC responds to UI Community HomeCare data security incident — University of Iowa campus press coverage of the August 29, 2025 disclosure.
• Top Class Actions — UI Community HomeCare data breach affects 211,000 patients — consumer litigation tracker confirming class action posture.
• Markovits, Stock & DeMarco — UI Community HomeCare Data Breach Class Action Investigation — fifth plaintiff firm publicly investigating claims; same firm also investigated the entity’s 2023 breach.
• WQAD — Data breach impacts University of Iowa Community Home Care users — Quad Cities local television coverage confirming breach scope and multi-state patient footprint.