Almeida Law Group is investigating a data breach at TennCare. If you were affected, contact Almeida Law Group.
About TennCare
TennCare is Tennessee’s Medicaid program, providing healthcare coverage to low-income pregnant women, parents or caretakers of minor children, children, and individuals who are elderly or have a disability. Administered by the Tennessee Division of TennCare, a state government agency, TennCare operates under a federal 1115 waiver and delivers services through managed care organizations. It is the largest department in the state budget. Because TennCare administers health coverage for vulnerable populations, the personal and health information it handles is particularly sensitive.
What Happened?
TennCare was listed in an HHS Office for Civil Rights breach portal report submitted on July 27th, 2026. According to that report, the incident was classified as an Unauthorized Access/Disclosure involving paper records or films. Approximately 2,300 individuals were affected. No business associate was listed as involved, meaning TennCare itself — not a vendor — appears to have been the covered entity directly responsible. The specific data types exposed were not reported, and no public notice letter or announcement describing the details of this incident has been found.
This is not the first time TennCare members have been affected by a data security event. In 2019, pharmacy benefits vendor Magellan Rx Management reported that an unauthorized third party accessed an employee email account containing TennCare member data, affecting approximately 43,847 members. In 2022, a system update caused some members to view information belonging to other households, affecting roughly 1,700 individuals. In 2023, TennCare vendor HealthEC experienced a ransomware incident in which an unknown actor accessed and copied files, prompting TennCare to suspend its Care Coordination Tool and all related functions.
Key Facts at a Glance
- Company or Organization: TennCare
- Industry: Government Health Plan (State Medicaid Program)
- Location: Tennessee (statewide program)
- Incident type: Unauthorized Access/Disclosure
- Date breach discovered: July 27th, 2026
- Total persons affected: 2,300
- Prior breach: Yes — 2019 (Magellan Rx Management email compromise, ~43,847 members); 2022 (system misconfiguration, ~1,700 members); 2023 (HealthEC ransomware incident)
- Source: HHS Office for Civil Rights breach portal report; TennCare – Tennessee.gov; Sycamore Institute – What is TennCare?; WBIR – 2019 breach; Paris Post-Intelligencer – 2022 incident; TennCare Privacy Update – 2023 HealthEC incident
What Should You Do?
If you believe you were affected by this breach, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Review your credit reports for any unfamiliar activity at AnnualCreditReport.com, where you can access free reports from each bureau. Because TennCare administers health coverage, it is also worth reviewing any Explanation of Benefits statements you receive and checking your medical records for services you did not authorize. If you notice suspicious activity or believe your identity has been misused, visit IdentityTheft.gov for step-by-step guidance on reporting and recovering from identity theft.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
