Almeida Law Group is investigating a data breach at Kentucky Mountain Health Alliance. If you were affected, contact Almeida Law Group.
About Kentucky Mountain Health Alliance
Kentucky Mountain Health Alliance, Inc. (KMHA) is a private nonprofit healthcare provider founded in 2005 and based in Hazard, Kentucky. It operates the Little Flower Clinic and a mobile medical clinic serving Perry County, providing primary care, dental care, behavioral health, substance use treatment, case management, and pharmacy access to homeless individuals, those at risk of homelessness, and other underserved populations in Southeastern Kentucky. Because KMHA serves vulnerable patients and maintains detailed medical and financial records, the information involved in this breach is particularly sensitive.
What Happened?
Kentucky Mountain Health Alliance was listed in a HHS Office for Civil Rights breach portal report filed on June 19th, 2026. The incident is classified as a hacking/IT incident affecting a network server, with no business associate involved. According to KMHA’s own breach notice as reported by HIPAA Journal, an unauthorized third party gained access to KMHA’s systems and copied patient data. A total of 30,830 individuals were affected. Notification letters were sent to affected individuals on June 12th, 2026, and KMHA also reported the breach to the Massachusetts Attorney General. KMHA is offering affected individuals free two-year identity monitoring services through Epiq’s Privacy Solutions ID program.
The compromised data includes names, Social Security numbers, driver’s license numbers and state identification numbers, passport numbers, financial account information, debit and credit card information, health insurance information, and medical information such as diagnoses, diagnosis codes, mental and physical condition details, prescription information, and provider names and locations. KMHA’s breach notification did not disclose when the incident occurred, how long unauthorized access lasted, or who the threat actor was. Shamis & Gentile P.A. has announced an investigation into the breach and is pursuing potential class action litigation on behalf of affected patients, though no filed lawsuit has been confirmed as of the latest available reporting.
Key Facts at a Glance
- Company or Organization: Kentucky Mountain Health Alliance, Inc.
- Industry: Healthcare Provider (Federally Qualified Health Center / Health Care for the Homeless grantee)
- Location: Hazard, Kentucky (Perry County)
- Incident type: Hacking/IT Incident — unauthorized access to network server with data copied
- Date of consumer notification: June 12th, 2026
- Date breach reported to HHS OCR: June 19th, 2026
- Total persons affected: 30,830
- Identity theft protection offered: Two-year identity monitoring through Epiq’s Privacy Solutions ID program
- Litigation status: Shamis & Gentile P.A. has announced an investigation and is pursuing potential class action litigation; no filed complaint confirmed as of the latest available reporting
- Source: HHS Office for Civil Rights breach portal report; HIPAA Journal
What Should You Do?
If you received a notification letter from Kentucky Mountain Health Alliance, enroll in the free two-year identity monitoring service through Epiq’s Privacy Solutions ID program before the enrollment deadline stated in your letter. You should also place a fraud alert or credit freeze with each of the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for someone to open new accounts in your name. Review your credit reports for unfamiliar accounts or inquiries at AnnualCreditReport.com, where you are entitled to free reports. Because medical information was involved, carefully review any Explanation of Benefits statements from your health insurer and request copies of your medical records to check for unfamiliar treatments or providers. If you spot signs of fraud or identity theft, report them and get a recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
