FlexCare, LLC, a provider of specialized patient care coordination and administrative health support services, reported a data security incident to the Maryland Attorney General on March 5, 2025. As a company that manages vast amounts of confidential patient and employee data for health plan enrollment and treatment coordination, FlexCare is a significant holder of sensitive personal and medical records. The specifics of the breach vector are under investigation, but such incidents often involve unauthorized access to critical systems.
The breach reportedly exposed a wide array of highly sensitive personal and protected health information. The compromised data includes individuals' Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates. This combination of data types creates substantial risks for affected individuals.
Unlike financial data that can be reissued, exposed medical information cannot be changed and carries severe, long-term consequences. This type of breach can lead to medical identity theft, where unauthorized parties use your information to obtain medical services, prescription drugs, or bill insurance under your name. Such misuse can compromise your medical history, lead to inaccurate records, and result in significant financial liabilities.
FlexCare, LLC operates under stringent federal and state regulations, including HIPAA and HITECH Acts, as well as Maryland data privacy laws. These frameworks mandate robust safeguards to protect electronic protected health information. A data breach of this nature suggests potential failures in upholding these crucial data protection standards and cybersecurity defenses.
If you received a data breach notification letter from FlexCare, LLC, it signifies that your private information was impacted due to this security incident. Receiving this letter provides the necessary foundation for you to consider legal action. Modern class action law often recognizes the mere exposure of sensitive data resulting from a breach as a compensable injury, even without immediate financial loss or identity theft. Our firm offers a no-cost case review, meaning you pay nothing unless we successfully recover compensation on your behalf.