The Devereux Foundation, a behavioral healthcare provider operating in Indiana, recently announced a data breach that exposed sensitive patient information. The incident, which occurred on November 6, 2025, was formally reported to the Indiana Attorney General on July 23, 2026, raising concerns among its patients and their families.
The exposed data categories include Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Clinical and Psychological Evaluation Records, and Contact and Mailing Address. This collection of data is particularly valuable to cybercriminals due to its sensitive nature.
Such a comprehensive data exposure carries significant risks for affected individuals. The compromise of your Social Security Number and Date of Birth, for example, can lead to identity theft, fraudulent financial activity, or unauthorized tax filings. When combined with Medical Record Number, Health Insurance ID Number, and detailed clinical records, the risk of targeted medical fraud and privacy invasion becomes even more acute.
As an entity entrusted with highly sensitive personal and health information, The Devereux Foundation had a legal duty to implement robust security measures to protect this data. Federal regulations, including the Health Insurance Portability and Accountability Act (HIPAA), alongside Indiana state laws, require healthcare providers to safeguard patient information. The occurrence of a breach indicates that these protective measures may have been insufficient.
If you received a data breach notification letter from The Devereux Foundation, it confirms that your private records were compromised. Receiving this letter provides the necessary legal standing to explore your options, including participating in a class action lawsuit. Our firm is actively investigating this breach and offers a free case review to help you understand your legal rights without any out-of-pocket costs.