Desert Orthopaedic Center Data Breach

Desert Orthopaedic Center patients may have had their Social Security numbers, Medicare or Medicaid IDs, diagnoses and insurance details copied by an unauthorized party. The practice waited about two months to post a public notice.

Desert Orthopaedic Center is an orthopedic medical group with five locations in Las Vegas and Henderson, Nevada.

On or about August 7, 2026, Desert Orthopaedic Center learned of a potential data privacy incident. Its investigation found that “certain DOC information may have been accessed or copied without authorization,” according to the practice’s notice. The notice does not say how the incident happened or who was behind it.

The practice posted a public notice on October 6, 2026. HIPAA Journal reported on October 12, 2026, that notification letters began mailing to affected individuals in early October.

Two Months Before Patients Heard About It

Desert Orthopaedic Center learned of the incident on or about August 7, 2026. Its public notice came on October 6, 2026. That is about two months, or 60 days. During that time, patients had no way to know their Social Security numbers and medical information may have been copied.

The timing of the letters is also not fully clear. The October 6 notice said letters would go out after the practice finished reviewing the data. HIPAA Journal reported six days later that mailing had already started in early October.

Desert Orthopaedic Center has not disclosed how many patients were affected. As of HIPAA Journal’s October 12 report, the incident did not yet appear on the federal HHS breach portal.

Sources: Desert Orthopaedic Center notice of data event, October 6, 2026; HIPAA Journal, October 12, 2026; Becker’s Spine Review, October 7, 2026.

Why This Combination of Data Is Dangerous

This breach paired Social Security numbers with Medicare or Medicaid ID numbers, health insurance details and medical history. That combination supports both kinds of identity theft at once:

• Financial identity theft: a Social Security number, name and date of birth can be enough to open credit in someone else’s name.
• Medical identity theft: Medicare, Medicaid and insurance numbers can be used to bill for care, equipment or prescriptions the patient never received.

Medical identity theft is often harder to spot than credit card fraud. It can also leave false diagnoses or treatments in a patient’s records.

What Information Was Exposed?

According to the notice, the information “varies by individual” and may include:

• Names and contact information
• Dates of birth
• Social Security numbers
• Treatment and diagnosis information
• Prescription and medication information
• Dates of service, provider names and locations
• Medical record numbers and patient account numbers
• Medicare or Medicaid ID numbers
• Health insurance information
• Medical billing and claims information

What Is Desert Orthopaedic Center Offering Patients?

The practice says it is offering complimentary credit monitoring and identity protection services. The public notice does not name the provider or say how long the services last. Patients should check their letter for enrollment instructions and any deadline.

The practice’s call center is 833-491-8244, Monday through Friday, 5:00 a.m. to 5:00 p.m. Pacific Time, excluding major U.S. holidays.

Your Information Is at Risk

Stolen Social Security numbers do not expire, and medical histories cannot be changed. Affected patients face a lasting risk of identity theft, insurance fraud and targeted phishing that uses real details from their records.

Affected individuals should:

• Enroll in the credit monitoring offered in the letter before any deadline.
• Place a fraud alert or security freeze with Equifax, Experian and TransUnion.
• Review Medicare Summary Notices, Medicaid statements and insurance Explanations of Benefits for unfamiliar care.
• Check credit reports at annualcreditreport.com.
• Treat calls or emails that mention this incident with caution.

Do You Have Legal Options?

Healthcare providers that collect Social Security numbers and medical records have a legal obligation to safeguard them and to notify patients promptly when they are exposed. When that obligation is not met, affected patients may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.  

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Frequently Asked Questions

How many people were affected by the Desert Orthopaedic Center data breach?

Desert Orthopaedic Center has not disclosed a number. As of October 12, 2026, the breach had not yet appeared on the HHS breach portal, which usually lists a count.

What information was exposed?

According to the notice, it varies by patient but may include:

• Name, contact information and date of birth
• Social Security number
• Treatment, diagnosis and medication information
• Medical record and patient account numbers
• Medicare or Medicaid ID number
• Health insurance and billing or claims information

When did the breach happen, and when were patients told?

The practice learned of the incident on or about August 7, 2026. It posted a public notice on October 6, 2026, about two months later. HIPAA Journal reported that letters began mailing in early October.

Is Desert Orthopaedic Center offering credit monitoring?

Yes. The practice says it is offering complimentary credit monitoring and identity protection. The public notice does not name the provider or the length of the service, so check your letter for details. You can also call 833-491-8244.

What should I do if I received a letter?

• Enroll in the free credit monitoring.
• Freeze your credit or place a fraud alert.
• Read every Medicare, Medicaid or insurance statement for care you did not receive.
• Be wary of messages that mention this breach.

Why is a Medicare or Medicaid ID number valuable to criminals?

These numbers let someone bill government health programs in your name. Fraudulent claims can use up benefits, create bills you did not run up and add false information to your medical record.

Do I have a legal claim?

Healthcare providers have a duty to protect patient information and to notify patients promptly after a breach. If you received a notice from Desert Orthopaedic Center, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.