Heritage Pediatrics Data Breach

A San Antonio pediatric practice says a hacked employee email account may have exposed Social Security numbers, medical details and payment information. The practice waited about six months to post its notice.

How the Heritage Pediatrics Email Incident Happened

Heritage Pediatrics PLLC is an independent pediatric practice on Broadway Street in San Antonio, Texas. Its patients are children, and parents or guardians usually handle their care and billing.

According to the practice’s Notice of Data Security Incident, on or about April 12 or 13, 2026, Heritage Pediatrics became aware of “fraudulent emails being sent from a single employee’s account.” The practice says it secured its network and investigated with outside cybersecurity professionals.

Heritage Pediatrics dated its notice October 19, 2026, and posted it on its website. The practice says it has no reason to believe the incident will lead to misuse of personal or health information. The notice does not describe what the unauthorized person viewed or took from the email account.

Why the Six-Month Delay Matters

About 189 days passed between the April 2026 incident and the October 19 notice. That is more than six months. Federal HIPAA rules (the law that protects patient health records) generally require healthcare providers to notify patients no later than 60 days after discovering a breach.

The notice does not say when Heritage Pediatrics learned that patient information was involved. It also does not explain why notice took this long. During that time, affected families had no warning to freeze credit or watch for fraud.

Heritage Pediatrics has not disclosed the total number of people affected. According to the Texas Attorney General’s data breach report list, at least 2,876 Texans were affected. That is a Texas-only count, so the full total may be higher.

What Information Was Exposed?

According to the notice, the information potentially involved includes full names plus one or more of the following. Not every item was involved for every person.

• Social Security number
• Full date of birth
• Driver’s license or state ID number
• Passport number
• Financial account information
• Debit or credit card information
• Health insurance information and policy number
• Clinical, diagnosis and treatment information
• Medical codes and medical record number

What Is Heritage Pediatrics Offering Affected Families?

The website notice does not offer free credit monitoring or identity protection, even though Social Security numbers are on the list. It names no vendor, coverage length or enrollment deadline.

The practice set up a call center at 1-800-664-7051, open Monday through Friday, 8 a.m. to 8 p.m. Eastern Time. The notice also explains how to place free fraud alerts and credit freezes and how to review insurance statements.

Children’s Information Is at Special Risk

A child’s Social Security number is valuable to criminals because it usually has no credit history. Thieves can open accounts under it, and the fraud may go unnoticed for years, often until the child applies for a first job, loan or apartment. Medical and insurance details add a second risk: medical identity theft, where someone uses another person’s identity to get care or file insurance claims.

Affected families should:

• Read the notice and call the practice’s call center with questions
• Request a free credit freeze for each affected child with Equifax, Experian and TransUnion
• Review insurance Explanation of Benefits statements for care the child did not receive
• Watch for phishing emails or calls that mention Heritage Pediatrics

Do You Have Legal Options?

Medical practices that collect children’s health records, Social Security numbers and payment details have a legal obligation to safeguard that information and to give timely notice when it is exposed. When that obligation is not met, affected individuals may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

FAQ

How many people were affected by the Heritage Pediatrics data breach?

Heritage Pediatrics has not stated a total. The Texas Attorney General’s list shows at least 2,876 Texans. People in other states may also be affected.

What information was exposed?

It depends on the person. According to the notice, it may include a name plus:

• Social Security number and date of birth
• Driver’s license, state ID or passport number
• Bank account and debit or credit card information
• Health insurance, diagnosis, treatment and medical record information

Why did it take so long to notify families?

The incident happened on or about April 12 or 13, 2026. The notice is dated October 19, 2026, about six months later. Heritage Pediatrics has not explained the delay. One section of the notice also lists August 31, 2023 as the potential disclosure date, without explaining it.

Why is a breach of children’s data different?

Children rarely check their credit, so fraud using a child’s Social Security number can go unnoticed for years. Parents or guardians can generally request a free credit freeze for a child under 16 with each of the three credit bureaus. A freeze stops new accounts from being opened in the child’s name.

What should I do if I received a notice?

• Freeze your credit and your child’s credit with all three bureaus
• Check bank and card statements for charges you do not recognize
• Review insurance Explanation of Benefits statements
• Keep a copy of the notice for your records

How do I avoid scams that mention the breach?

This incident started with fraudulent emails, so be extra careful. Do not click links or share personal details in messages that mention Heritage Pediatrics. Call the practice at a number you already trust.

Do I have a legal claim?

Healthcare providers have a duty to protect your family’s medical and personal information and to tell you promptly when it is exposed. If you or your child was a patient of Heritage Pediatrics, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.