NextStep Care, a Georgia healthcare provider, notified HHS in September 2026 that 685 individuals were affected by unauthorized access to paper records. The specific data categories involved have not been publicly disclosed. Affected individuals should monitor credit reports, watch for phishing, and consider a fraud alert or credit freeze as a precaution.
| Company | NextStep Care |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Not Publicly Disclosed |
| People Affected | 685 individuals |
| Attack Method | Unauthorized Access/Disclosure |
| Regulators Notified | HHS Office for Civil Rights |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the NextStep Care Data Breach?
Source Care Management, LLC, doing business as NextStep Care, has notified federal regulators about a data breach involving paper records. The Georgia-based healthcare provider filed its formal disclosure with the HHS Office for Civil Rights in September 2026. As a result, the incident is now part of the public record of health data breaches nationwide.
According to the filing, the breach involved unauthorized access to or disclosure of physical documents. This differs from many modern breaches that involve hacked computer networks. Instead, this incident centers on paper and film records, which suggests a physical security lapse rather than a cyberattack. The exact circumstances behind how someone gained access to these files have not been publicly disclosed.
The breach discovery date has not been publicly disclosed either. However, the notification itself was filed in September 2026, which starts the clock on regulatory reporting obligations. Because the breach involves protected health information, NextStep Care is required to investigate the scope of the exposure. At this stage, the company has not released additional forensic details beyond what appears in its regulatory filing.
Who was affected?
The breach notification indicates that 685 individuals were affected. Given that NextStep Care operates as a healthcare provider, those affected are most likely patients or clients who received care coordination or home-based services through the organization. In addition, some employees could potentially be included, though the filing does not specify a breakdown.
The geographic scope of the breach has not been publicly disclosed beyond the fact that NextStep Care is based in Georgia. Therefore, it is reasonable to assume most affected individuals live in or near that state. It remains unclear whether any minors are among those affected, since the filing does not address age demographics.
What Information Was Potentially Exposed?
The HHS filing identifies the breach as involving unauthorized access to or disclosure of paper and film records. However, the specific categories of information contained in those records have not been publicly disclosed. As a result, this article cannot confirm which exact data elements, such as names, diagnoses, or identification numbers, were involved.
Even without confirmed data categories, this type of incident still carries real risk. For instance, healthcare paperwork often includes identifying details that could be misused if it falls into the wrong hands. Because the affected individuals cannot yet know precisely what was exposed, uncertainty itself becomes a source of stress and vigilance.
Generally speaking, when a healthcare provider reports unauthorized access to records, affected individuals should consider the possibility of identity theft or medical fraud. This is because paper health records frequently include sensitive identifiers tied to insurance or billing. Consequently, people connected to NextStep Care may want to stay alert for unusual account activity or unexpected medical bills, even though no specific data type has been confirmed.
What is the company doing?
NextStep Care has taken the step of filing a formal data breach notification with the HHS Office for Civil Rights. This filing fulfills a key legal requirement under HIPAA for healthcare entities that experience a breach affecting protected health information. The organization also filed formal notification with the HHS Office for Civil Rights, as required by federal law.
Beyond the regulatory filing, the source material does not describe additional remediation steps. For example, it does not mention whether NextStep Care has implemented new physical security controls for paper records. Likewise, there is no public confirmation of credit monitoring or identity protection services being offered to affected individuals at this time.
Because HIPAA requires covered entities to investigate breaches thoroughly, NextStep Care is likely conducting an internal review. However, further public updates, if any, have not yet been disclosed. Affected individuals should watch for direct mail or email notifications from the organization describing next steps.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Anyone connected to NextStep Care should consider pulling a free copy of their credit report from each of the three major bureaus. This allows you to look for accounts or inquiries you do not recognize. Because breach notifications sometimes arrive weeks or months after the underlying incident, starting this habit now is a smart precaution.
In addition, reviewing reports regularly, rather than just once, helps catch fraud that might appear later. Identity thieves do not always act immediately after obtaining personal records. As a result, ongoing monitoring over the coming months is more effective than a single check.
Watch for Phishing and Scam Attempts
Following any healthcare data breach, affected individuals often become targets of phishing emails, texts, or phone calls. Scammers may pose as NextStep Care representatives or insurance agents to extract further information. Therefore, it is wise to avoid clicking links or sharing details with anyone who contacts you unexpectedly.
Instead, if you receive a message claiming to be from NextStep Care, verify it independently. For example, you can call the organization directly using a number from its official website rather than one provided in the suspicious message. This simple step can prevent a secondary scam from compounding the original breach.
Consider a Fraud Alert or Credit Freeze
Even though specific data categories have not been confirmed, placing a fraud alert on your credit file is a low-cost protective measure. A fraud alert requires lenders to take extra steps to verify your identity before approving new credit. This can slow down identity thieves who might attempt to open accounts in your name.
Alternatively, a credit freeze offers even stronger protection by restricting access to your credit file entirely. While a freeze requires a few extra steps when you want to apply for credit yourself, it remains one of the most effective tools against unauthorized account openings. Because healthcare breaches can involve identifying details, this precaution is worth considering here.
Keep Records of Medical and Insurance Statements
Because NextStep Care is a healthcare provider, it is worth reviewing any insurance Explanation of Benefits statements you receive. If you notice unfamiliar charges or services you never received, this could indicate medical identity theft. Reporting discrepancies quickly to your insurer can prevent further fraudulent billing.
Furthermore, keeping a simple file of your medical paperwork from the past year can help you spot inconsistencies faster. This way, if a fraudulent claim appears, you have your own records to compare against. Consulting a data breach attorney can also help you understand what options may be available if you experience direct harm from this incident.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
View the public data breach notification listing from HHS Office for Civil Rights