North East Medical Services Data Breach
A cybersecurity incident at North East Medical Services (NEMS) is putting tens of thousands of California patients on alert. The San Francisco-based nonprofit community health center, which serves over 70,000 patients annually across locations in San Francisco, Daly City, and San Jose, recently notified the California Attorney General that sensitive personal information belonging to an undetermined number of individuals may have been accessed without authorization. Contact our data breach lawyers to learn more.
What We Know About the NEMS Breach
On October 19, 2025, NEMS detected potential unauthorized access to certain data stored on the network of its third-party hosted managed service provider, United Layer. The intrusion was not contained within NEMS’s own systems — it originated through a vendor, a trend that has become alarmingly common across the healthcare industry. Once the breach was identified, NEMS launched an investigation to determine the scope of what was accessed and which individuals were affected.
As of mid-February 2026, the exact categories of personal information potentially exposed have not been made publicly available, leaving patients without a complete picture of their risk. What has been confirmed is that NEMS has begun mailing breach notification letters to affected individuals and is offering complimentary credit monitoring services — standard steps that, while helpful, represent only a starting point for those whose data may now be in the hands of unauthorized third parties.
The number of patients impacted remains unknown. The incident has not yet appeared on the HHS Office for Civil Rights breach portal. When that reporting occurs, the full scale of the breach will become clearer, and so will the legal landscape for affected patients.
Why Third-Party Vendor Breaches Are Especially Troubling
The NEMS incident follows a pattern that cybersecurity experts have been warning about for years. Healthcare organizations increasingly rely on outside managed service providers to store, process, and protect sensitive data. When those vendors are compromised, the ripple effects extend to every patient whose information flows through that system, regardless of whether the healthcare provider itself did anything wrong.
For patients, the concern is immediate. Medical records contain some of the most sensitive information that exists — diagnoses, treatment histories, insurance details, and identifying information that criminals can exploit for identity theft, insurance fraud, and financial crimes that can take years to untangle.
What Affected Patients Should Do Right Now
If you are a current or former NEMS patient and receive a breach notification letter, take it seriously. Read it carefully and preserve it as a record. Enroll in the complimentary credit monitoring being offered, but understand that credit monitoring does not prevent fraud — it only alerts you after the fact. Monitor your financial accounts and explanation of benefits statements for unfamiliar activity. Consider placing a fraud alert or security freeze with the three major credit bureaus to make it harder for bad actors to open accounts in your name.
Most critically, do not assume that because you haven’t noticed anything yet, there is no risk. Stolen healthcare data is frequently held and used months or years after a breach occurs. Patience is a tool that cybercriminals use deliberately.
Your Legal Rights Under California Law and HIPAA
California patients benefit from some of the strongest data privacy protections in the country. The California Consumer Privacy Act and California’s Confidentiality of Medical Information Act both impose obligations on organizations that handle personal and medical data, and violations can give rise to civil liability.
Where a covered entity or its vendor fails to implement reasonable security measures and a breach results, affected individuals may have grounds to pursue legal action for damages — including compensation for time spent responding to the breach, out-of-pocket costs, and in some cases statutory damages.
The Lyon Firm Represents Data Breach Victims
The Lyon Firm represents individuals whose personal and medical information has been compromised due to inadequate data security practices. We understand how disorienting and stressful a data breach can be — especially when it involves a healthcare provider you trusted with sensitive information. Our attorneys have experience navigating the intersection of HIPAA, state privacy law, and consumer protection statutes, and we know how to hold organizations and their vendors accountable.
If you were a NEMS patient and believe your data was exposed, contact The Lyon Firm today for a free, confidential consultation.