Hillcrest Convalescent Center, Inc. Data Breach Notice (Oregon Attorney General)

The filing from Hillcrest Convalescent Center, Inc. means that personal information belonging to 106,194 people is now outside the organisation’s control. Because this is a nursing and convalescent facility, the records almost certainly include the kind of details that tie directly to someone’s medical and personal history.

No passwords or credentials were exposed

This is genuinely good news. The notification lists only personal information. There is no indication that any password, login, or authentication data was involved. You do not need to change any password because of this incident.

What the exposed personal information actually enables

Name combined with date of birth, address, and medical identifiers creates a durable package for identity thieves. These details do not expire. A Social Security number is not required for every fraud scheme; many forms of medical identity theft, insurance fraud, and synthetic identity creation succeed with exactly the categories named in this filing.

Once this information leaves a regulated healthcare provider it can be sold, repackaged, or held for years. The people whose records were included now carry a slightly elevated risk of fraud that may not appear for months.

The letter is the only reliable way to know if you are affected

Hillcrest Convalescent Center is required to notify affected individuals directly, usually by mail. If you have not received a letter, your information was most likely not part of the 106,194 records included in the filing. However, anyone who has moved since the incident should contact the facility directly to confirm their status. Absence of a letter is usually meaningful, but last-known-address mail is never perfect.

Why medical identifiers matter long after the breach

Medical information tied to your name and date of birth can be used to file false claims, order prescriptions in your name, or create records that later confuse your own treatment. Unlike a credit card, you cannot cancel your medical history. The exposure is permanent even though the filing does not list government identifiers such as a full Social Security number.

The scale — more than 106,000 individuals — is large for a single convalescent center. It reflects the breadth of residents and former patients whose records were held rather than any detail the filing provides about how the breach occurred.

What remains under your control

You cannot change the fact that the data exists outside the facility. You can reduce what thieves are able to do with it. The most effective steps focus on early detection of misuse rather than prevention of something that has already happened.

• Review every Explanation of Benefits statement from your health insurer as soon as it arrives. Look for services you did not receive. Medical identity theft is often spotted first on an EOB.
• Place a fraud alert with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts and adds a visible flag if someone tries to use your name and date of birth.
• Monitor your Medicare or insurance account online weekly for the next twelve months. Unexpected claims or changes of address are common early signs.
• Request your free annual credit reports and check for accounts or addresses you do not recognise. Because medical data is involved, also watch for collection notices from unfamiliar providers.
• If you receive any unsolicited calls, texts, or mailings that reference your care at Hillcrest, treat them as suspicious even if they appear legitimate.

The filing does not state when the incident occurred, only that the notification reached the Oregon Department of Justice on March 04, 2025. Without an incident date it is impossible to calculate how long the information may have been accessible. The record is silent on the method of exposure, whether the data was copied, and whether any encryption was in place.

What matters most is that 106,194 people now face the practical consequences of their personal and medical details circulating beyond the facility’s walls. The letter you may or may not have received remains the clearest signal of whether this specific filing applies to you. Where it does, the exposure cannot be undone, but its practical harm can still be limited through vigilance focused on medical billing and new-account fraud.