Risk Program Administrators Data Breach

Risk Program Administrators, LLC reported a hacking incident to federal health-privacy regulators affecting 8,309 people. The California-based business associate has not said what personal information was exposed.

Risk Program Administrators, LLC, a California-based insurance and risk-management business, reported a data breach to the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR) on July 23, 2026. The filing describes a hacking/IT incident involving email and lists 8,309 affected individuals. HHS OCR lists Risk Program Administrators as a Business Associate, meaning it holds data on behalf of one or more insurance carriers or health plans rather than serving as the primary insurer itself.

Source: HHS Office for Civil Rights Breach Portal, Risk Program Administrators, LLC (submission dated 07/23/2026, 8,309 individuals, California).

A Business Associate Breach Can Affect People Who Never Dealt With the Company Directly

Risk Program Administrators is listed as a Business Associate under federal health-privacy law, which means it processes or stores data for other companies, such as insurance carriers or self-funded health plans, rather than serving customers under its own name. That arrangement means people who were never direct customers of Risk Program Administrators may still be affected if their information passed through the company’s systems. The specific downstream insurance carriers or health plans involved have not been publicly identified.

What Information Was Exposed?

The HHS OCR filing confirms the breach involved a hacking/IT incident affecting email systems but does not itemize the specific categories of personal or health information involved, unlike a typical state Attorney General filing. If you received a notice letter, it should list the categories of information specific to you.

How Many People Are Affected?

Risk Program Administrators reported 8,309 affected individuals to HHS OCR. The filing lists California as the affected jurisdiction; whether that figure represents a national total or a California-specific count has not been separately clarified by the company.

What Is Risk Program Administrators Offering Affected Individuals?

Risk Program Administrators has not publicly disclosed whether it is offering credit monitoring or identity protection services to affected individuals. Anyone who received a notice letter should review it directly for enrollment instructions or contact information.

Your Information Is at Risk

Because Risk Program Administrators works with insurance carriers and health plans, an email-based hack at a company like this can expose a mix of identifying and health-related information, even when the specific categories haven’t been made public. That combination can be used for identity theft, insurance fraud, or medical identity theft. Affected individuals should monitor financial accounts and insurance statements for unfamiliar activity and watch for phishing attempts that reference this incident.

Do You Have Legal Options?

Business associates that handle insurance and health-related data on behalf of other companies have a legal duty to secure that information and to notify affected individuals without unreasonable delay.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review if you received a notice letter from Risk Program Administrators.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

Who is affected by the Risk Program Administrators data breach?

8,309 individuals, according to Risk Program Administrators’ filing with HHS OCR. Because the company is a Business Associate, affected individuals may include customers of insurance carriers or health plans that Risk Program Administrators works with, not just its own direct customers.

What information was exposed?

Risk Program Administrators has not publicly itemized the specific categories of personal or health information involved. The HHS OCR filing confirms a hacking/IT incident involving email. If you received a notice letter, it should specify the categories of information specific to you.

What is a ‘Business Associate’ and why does it matter here?

Under federal health-privacy law, a Business Associate is a company that handles health-related data on behalf of another organization, such as an insurance carrier or health plan, rather than serving as that plan or carrier itself. That means people affected by this breach may not have a direct relationship with Risk Program Administrators at all.

Is Risk Program Administrators offering credit monitoring?

That has not been publicly disclosed. If you received a notice letter, check it directly for enrollment instructions or contact information.

Has my information actually been misused?

No confirmed instances of identity theft or fraud tied to this breach have been publicly reported. That does not mean the underlying exposure didn’t happen, only that no confirmed misuse has surfaced yet.

Do I have a legal claim?

Business associates that handle insurance and health-related information on behalf of other companies have a legal duty to secure that data and to notify affected individuals without unreasonable delay. If you received a notice letter from Risk Program Administrators, contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.