Almeida Law Group is investigating a data breach at WindRose Health Network. If you were affected, contact Almeida Law Group.
About WindRose Health Network
WindRose Health Network is a Federally Qualified Health Center (FQHC) founded in 1996 as a Rural Health Center in Trafalgar, Indiana. It operates five health centers serving southern Indianapolis through Johnson and Bartholomew counties, providing family medicine, prenatal care, pediatric health, behavioral health, chiropractic care, and HIV/PrEP services. The network serves uninsured and underinsured patients on a sliding fee scale and employs approximately 150 physicians, nurses, clinicians, and support staff who collectively speak more than 20 languages.
What Happened?
WindRose Health Network was listed in an HHS Office for Civil Rights breach portal report submitted on September 16th, 2026. The incident was classified as a Hacking/IT Incident involving a network server, with no business associate present. A total of 33,158 individuals were affected.
According to HIPAA Journal, unauthorized access to WindRose Health Network’s systems began on the morning of August 22nd, 2025, and was detected the same day. The organization engaged a data review firm to determine what information was exposed and which individuals were affected, a process that was recently completed as of the reporting date. Third-party cybersecurity experts were also brought in to investigate the incident and further secure the network’s systems. The HHS OCR breach report was filed on September 16th, 2026 — approximately 13 months after the incident date, a delay that appears to reflect the time required to complete the data review process and identify all affected individuals.
The types of information exposed vary by individual and may include names, contact information, date of birth, patient identification number, dates of service, provider names, diagnosis and treatment information, prescriptions, medical history, lab reports, health insurance information, and for a limited number of individuals, government identification numbers such as a driver’s license number or Social Security number.
Key Facts at a Glance
- Company or Organization: WindRose Health Network
- Industry: Healthcare Provider – Federally Qualified Health Center (FQHC)
- Location: Indiana – locations in Trafalgar, Hope, Edinburgh, Whiteland, Indianapolis (Epler Parke), and Franklin
- Incident type: Hacking/IT Incident – Network Server
- Date of breach: August 22nd, 2025
- Date breach discovered: August 22nd, 2025
- Date of consumer notification: September 16th, 2026
- Total persons affected: 33,158
- Litigation status: No class action lawsuits or litigation connected to this incident have been identified
- Source: HHS OCR Breach Portal; HIPAA Journal
What Should You Do?
If you received a notice from WindRose Health Network, review it carefully for instructions on any identity or credit protection services being offered and enroll before any deadline. Regardless of whether protection is offered, you should place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports for unauthorized activity at AnnualCreditReport.com. Because health and insurance information was involved in this breach, also review your Explanation of Benefits statements and medical records for services you did not receive or other unfamiliar entries. If you suspect misuse of your personal information, visit IdentityTheft.gov for guided recovery steps.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
