LHC Group, Inc. Data Breach Notice (Washington Attorney General)

The April 07, 2026 breach at LHC Group, Inc. means that 6,602 people — including Washington residents — now have their most sensitive personal and medical records in unknown hands. The filing reached the Washington State Attorney General on September 04, 2026, 150 days after the incident date. That nearly five-month gap is the single most striking fact in the record.

A Social Security Number paired with a full date of birth does not expire

If your information was included, the combination of your name, Social Security number, and full date of birth remains permanently usable for identity theft. These three pieces together allow someone to open credit accounts, file fraudulent tax returns, or apply for government benefits in your name. Unlike a credit card or password, none of them can be replaced or cancelled.

The same filing lists financial and banking information, health insurance policy or ID numbers, medical information, and protected health information owned or licensed by a HIPAA covered entity. Medical identity theft is a realistic risk here: someone could use your health insurance ID to obtain care, rack up bills in your name, or file false claims that corrupt your medical record.

What the 150-day interval actually tells you

The record shows the incident occurred on April 07, 2026 and the notification was filed on September 04, 2026. Notification timelines vary by state law and by when an investigation concludes, so the filing itself does not establish fault. What it does establish is that nearly five months passed between those two dates. During that period the exposed records were outside LHC Group’s direct control.

No passwords were exposed. The filing contains no credential data, which removes one major category of immediate risk. You do not need to change any password tied to LHC Group services because none was compromised.

Why medical and insurance details matter long after the breach

Health insurance policy numbers and medical information do not lose their value the way stolen credit cards do. A thief can continue submitting claims, ordering prescriptions, or seeking treatment under your insurance for years. Errors introduced into your medical history can follow you for decades, affecting future care and insurance premiums.

The record lists protected health information owned or licensed by a HIPAA covered entity. This is not generic “medical data.” It is the detailed clinical and billing information that HIPAA was written to protect. Its exposure creates both financial fraud risk and privacy risk that cannot be undone by freezing a credit report.

How to determine whether this filing includes you

LHC Group is required to notify affected individuals directly, usually by mail to the last known address. If you have not received a letter, your records were most likely not part of the 6,602 affected. However, if you have moved since April 07, 2026, the letter may have gone to an old address. In that case, contact LHC Group directly to confirm whether your information was included.

The permanent exposures you cannot fix

Your full date of birth and Social Security number cannot be reissued. Once they are loose, the best available defense is constant vigilance rather than a one-time fix. The financial and banking information listed in the filing can be monitored and disputed, but the underlying identifiers stay the same.

This is why the combination of SSN and date of birth is treated as especially serious: it is the exact pair required to impersonate someone on credit applications, healthcare forms, and government portals. The addition of medical and insurance records simply widens the possible fraud types.

What remains under your control

While some consequences cannot be prevented, several practical steps still reduce the realistic harm. The most useful actions address the specific categories named in the Washington filing rather than generic breach advice.

• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion immediately. A freeze stops new credit accounts from being opened in your name using the exposed Social Security number and date of birth. It is the single most effective step available for the permanent identifiers in this incident.
• Review every Explanation of Benefits statement from your health insurer. Look for claims you did not receive care for. Medical identity theft often appears first as services billed to your insurance that you never used. Report discrepancies to your insurer at once.
• Monitor bank and credit card statements for at least the next 24 months. The financial and banking information listed means unauthorized transactions could appear long after the breach. Set up transaction alerts so you are notified of any movement rather than waiting for monthly statements.
• Obtain and examine your full medical records from every provider you have used in the past five years. Compare them against what you know to be true. Early detection of corrupted medical information is the only practical defense against long-term record contamination.
• File your taxes as early as possible each year and respond quickly to any IRS notice. Tax refund fraud using stolen Social Security numbers and dates of birth is common after breaches that expose both fields. Early filing reduces the window available to imposters.

The record is silent on whether the data was merely accessed or actually exfiltrated, and it discloses nothing about the root cause. Those uncertainties do not change the concrete situation for the 6,602 people whose information appears in the filing: their name, Social Security number, date of birth, financial details, health insurance ID, and medical records are now outside the organisation’s custody.

Because the most damaging pieces cannot be changed, the practical response is ongoing monitoring and rapid reaction rather than any illusion of a complete fix. The letter from LHC Group remains the definitive way to know whether you are one of the 6,602 affected. Its absence is usually meaningful, but anyone who has changed address since the April 07, 2026 incident date should verify directly with the organisation.