SSM Health ssmhealth.com SSM Health data breach: what happened and what to do
SSM Health told HHS in March 2026 that a business associate's network was breached, affecting the health information of 597 people. It involved clinical, demographic and financial information. Credit monitoring was offered.
View all 13,177 breaches- Breach date
- 11 Mar 2026
- Made public
- 11 Mar 2026
- Affected
- 597
- Data exposed
- Clinical information, Demographic information, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
SSM Health, a US health system, reported a data breach to the US Department of Health and Human Services (HHS) on 11 March 2026. The breach did not happen on SSM Health's own systems. According to HHS's listing, one of its business associates (a vendor that handles patient information on its behalf) had its network breached.
HHS's breach portal lists 597 people affected. The description on the portal names the type of information as clinical, demographic and financial. It doesn't give a more detailed list, such as whether Social Security numbers were included, so the letter you receive is the place to check exactly what was involved in your case.
According to the HHS entry, SSM Health notified HHS, the affected individuals and the media, and posted a substitute notice (a public notice used when direct contact isn't possible). It offered the affected people complimentary credit monitoring. Both SSM Health and the business associate say they added administrative and technical safeguards to protect health information better. HHS classes the cause as a hacking or IT incident.
What this means for you: if you were treated at SSM Health and get a letter, health and financial details can be used for medical identity theft, for fake billing and for convincing phishing that quotes real appointments or providers. Treat unexpected calls, texts or emails about your care or a bill with suspicion, and contact the provider using a number you already trust. If you accept the credit monitoring in your letter, do it before the deadline it gives.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Read your notice letter and use the offered credit monitoring
The letter says what was involved for you and how to enrol in the free credit monitoring SSM Health offered. Use the enrolment deadline printed on it.
- 2
Read your health insurance statements
Look through explanation of benefits statements for treatment you didn't receive. If something looks wrong, tell your insurer and report identity theft at IdentityTheft.gov.
- 3
Treat messages about your care with suspicion
Criminals can use real provider details to sound convincing. Don't click links or give details to unexpected callers. Call the provider on a number you already have.
- 4
Put a free credit freeze in place
A freeze stops new accounts being opened in your name. It's free at Equifax, Experian and TransUnion, and the FTC explains how: credit freezes and fraud alerts.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know what to act on.
Official filings
- U.S. Department of Health and Human Services , filed 11 Mar 2026 : 597 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the SSM Health data breach?
Affected people are sent a letter. HHS lists 597 people. If you haven't received one, you can ask SSM Health directly.
What was exposed in the SSM Health breach?
HHS describes the information as clinical, demographic and financial. The listing doesn't break it down further, so check your letter.
Was the breach on SSM Health's own network?
According to the HHS listing, the breach affected the network of a business associate, a vendor that handles patient information for SSM Health.
Do I get free credit monitoring?
HHS's entry says SSM Health offered complimentary credit monitoring to the affected people. Your letter explains how to enrol.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
