Dorsata data breach

What happened

Dorsata, Inc., which provides technology used with the electronic health records of women's health clinics and physicians, is notifying patients that their protected health information may have been exposed, and filed a sample notice with the California Attorney General, which posted it on November 9, 2026. Dorsata says it learned on August 12, 2026 that the Metabase business intelligence software it uses had a security flaw, and found that the flaw allowed unauthorized access to its database platform from August 10 to 12. The data may include name and other health information that the public sample letter does not list; Social Security numbers were not involved. Dorsata says patients' healthcare providers asked it to send the notices, that it has no evidence of misuse, and it has not published how many people were affected.

What should I do?

1. Read your letter to see exactly which health information was involved, and call the number in it (1-800-655-5832) with questions.
2. Review explanation-of-benefits statements from your health insurer for visits or services you didn't receive.
3. Be wary of calls, emails or texts that mention your clinic or care and ask for personal or payment details.
4. If you see medical services you don't recognize, contact your provider and insurer.

More data breaches in the United States →

Check the other services you use →