Regulatory Disclosure Notice
Blossom Health, operating as Blossom BH Opco, Inc. and its affiliated professional entities (collectively, "Blossom Health," "we," or "us"), are a covered entity within the meaning of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 ("HIPAA"), as codified at 42 U.S.C. §§ 1320d–1320d-9. We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of protected health information ("PHI") in accordance with the federal and state authorities identified in this Notice, and this Notice is published as the required and voluntary disclosure of that framework.
Blossom Health maintains compliance with the regulations promulgated by the U.S. Department of Health and Human Services ("HHS") thereunder, including the Standards for Privacy of Individually Identifiable Health Information (the "Privacy Rule"), 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E; the Security Standards for the Protection of Electronic Protected Health Information (the "Security Rule"), 45 C.F.R. Part 164, Subparts A and C; and the Notification in the Case of Breach of Unsecured Protected Health Information (the "Breach Notification Rule"), 45 C.F.R. Part 164, Subpart D. The individual's right to receive a notice of privacy practices is observed pursuant to 45 C.F.R. § 164.520. These obligations are further informed by the Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5, Title XIII (the "HITECH Act"). Compliance is subject to the enforcement authority of the HHS Office for Civil Rights ("OCR") under the Enforcement Rule, 45 C.F.R. Part 160, Subparts C, D, and E.
In each state in which Blossom Health is active, we observe the applicable data-privacy, health-information-confidentiality, and notification laws of that jurisdiction, in addition to and to the extent not preempted by the federal authorities above, including without limitation: New York (N.Y. Gen. Bus. Law §§ 899-aa, 899-bb; Mental Hygiene Law § 33.13); New Jersey (N.J.S.A. 56:8-161 et seq.); Florida (Fla. Stat. § 501.171); Illinois (815 ILCS 530; 740 ILCS 110); Pennsylvania (73 P.S. §§ 2301–2330); Washington (Wash. Rev. Code ch. 19.373; RCW 19.255); California (Cal. Civ. Code §§ 56 et seq. and §§ 1798.100 et seq.); Texas (Tex. Health & Safety Code ch. 181; Tex. Bus. & Com. Code ch. 521); Virginia (Va. Code §§ 59.1-575 et seq.); North Carolina (N.C. Gen. Stat. §§ 75-60 et seq.); Ohio (Ohio Rev. Code § 1354; § 1349.19); Michigan (MCL §§ 445.61 et seq.); Arizona (Ariz. Rev. Stat. § 18-552); Maryland (Md. Code, Com. Law §§ 14-3501 et seq.); Colorado (Colo. Rev. Stat. §§ 6-1-1301 et seq.); Indiana (Ind. Code §§ 24-15 et seq.; § 24-4.9); Georgia (Ga. Code §§ 10-1-910 et seq.); Oregon (Or. Rev. Stat. §§ 646A.570 et seq.); Massachusetts (201 CMR 17.00; Mass. Gen. Laws ch. 93H); and Connecticut (Conn. Gen. Stat. §§ 42-515 et seq.).
This Notice applies to PHI created, received, maintained, or transmitted by Blossom Health in any form or medium, and each citation herein includes the referenced authority as amended from time to time and the regulations promulgated thereunder. The inclusion of any authority is a statement of the framework we observe and is not a representation that every provision applies to every service or circumstance, and no provision of this Notice creates any right or remedy not otherwise provided by law. This Notice is informational, is not legal advice, and does not modify the rights or obligations set forth in our Notice of Privacy Practices, which controls in the event of any conflict. We reserve the right to amend this Notice to reflect changes in applicable law or our practices, effective upon publication with a revised effective date.
Blossom BH Opco Inc. (“Blossom Health”) is providing notice to impacted individuals of a recent event via this posting. Blossom Health identified suspicious activity in its electronic health records (“EHR”) software and immediately took action to secure the EHR. There is no evidence that any personal information has been or will be misused as a result of this incident. The security of personal information is very important to us, and we sincerely apologize for any inconvenience this may cause.
Blossom Health, operating as Blossom BH Opco, Inc. and its affiliated professional entities (collectively, "Blossom Health," "we," or "us"), are a covered entity within the meaning of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 ("HIPAA"), as codified at 42 U.S.C. §§ 1320d–1320d-9. We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of protected health information ("PHI") in accordance with the federal and state authorities identified in this Notice, and this Notice is published as the required and voluntary disclosure of that framework.
Blossom Health maintains compliance with the regulations promulgated by the U.S. Department of Health and Human Services ("HHS") thereunder, including the Standards for Privacy of Individually Identifiable Health Information (the "Privacy Rule"), 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E; the Security Standards for the Protection of Electronic Protected Health Information (the "Security Rule"), 45 C.F.R. Part 164, Subparts A and C; and the Notification in the Case of Breach of Unsecured Protected Health Information (the "Breach Notification Rule"), 45 C.F.R. Part 164, Subpart D. The individual's right to receive a notice of privacy practices is observed pursuant to 45 C.F.R. § 164.520. These obligations are further informed by the Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5, Title XIII (the "HITECH Act"). Compliance is subject to the enforcement authority of the HHS Office for Civil Rights ("OCR") under the Enforcement Rule, 45 C.F.R. Part 160, Subparts C, D, and E.
In each state in which Blossom Health is active, we observe the applicable data-privacy, health-information-confidentiality, and notification laws of that jurisdiction, in addition to and to the extent not preempted by the federal authorities above, including without limitation: New York (N.Y. Gen. Bus. Law §§ 899-aa, 899-bb; Mental Hygiene Law § 33.13); New Jersey (N.J.S.A. 56:8-161 et seq.); Florida (Fla. Stat. § 501.171); Illinois (815 ILCS 530; 740 ILCS 110); Pennsylvania (73 P.S. §§ 2301–2330); Washington (Wash. Rev. Code ch. 19.373; RCW 19.255); California (Cal. Civ. Code §§ 56 et seq. and §§ 1798.100 et seq.); Texas (Tex. Health & Safety Code ch. 181; Tex. Bus. & Com. Code ch. 521); Virginia (Va. Code §§ 59.1-575 et seq.); North Carolina (N.C. Gen. Stat. §§ 75-60 et seq.); Ohio (Ohio Rev. Code § 1354; § 1349.19); Michigan (MCL §§ 445.61 et seq.); Arizona (Ariz. Rev. Stat. § 18-552); Maryland (Md. Code, Com. Law §§ 14-3501 et seq.); Colorado (Colo. Rev. Stat. §§ 6-1-1301 et seq.); Indiana (Ind. Code §§ 24-15 et seq.; § 24-4.9); Georgia (Ga. Code §§ 10-1-910 et seq.); Oregon (Or. Rev. Stat. §§ 646A.570 et seq.); Massachusetts (201 CMR 17.00; Mass. Gen. Laws ch. 93H); and Connecticut (Conn. Gen. Stat. §§ 42-515 et seq.).
This Notice applies to PHI created, received, maintained, or transmitted by Blossom Health in any form or medium, and each citation herein includes the referenced authority as amended from time to time and the regulations promulgated thereunder. The inclusion of any authority is a statement of the framework we observe and is not a representation that every provision applies to every service or circumstance, and no provision of this Notice creates any right or remedy not otherwise provided by law. This Notice is informational, is not legal advice, and does not modify the rights or obligations set forth in our Notice of Privacy Practices, which controls in the event of any conflict. We reserve the right to amend this Notice to reflect changes in applicable law or our practices, effective upon publication with a revised effective date.
Blossom BH Opco Inc. (“Blossom Health”) is providing notice to impacted individuals of a recent event via this posting. Blossom Health identified suspicious activity in its electronic health records (“EHR”) software and immediately took action to secure the EHR. There is no evidence that any personal information has been or will be misused as a result of this incident. The security of personal information is very important to us, and we sincerely apologize for any inconvenience this may cause.
What Happened?
On August 27, 2026, we became aware of suspicious activity in our EHR software. We immediately implemented our incident response protocols and conducted an investigation to determine what occurred and whether any data may have been impacted. Our investigation determined on August 27, 2026 that an unauthorized individual accessed the EHR and downloaded a limited number of patient medical records and a user spreadsheet containing patient information. We found no evidence of any actual misuse of this information, but wanted to provide you with notice out of an abundance of caution.
On August 27, 2026, we became aware of suspicious activity in our EHR software. We immediately implemented our incident response protocols and conducted an investigation to determine what occurred and whether any data may have been impacted. Our investigation determined on August 27, 2026 that an unauthorized individual accessed the EHR and downloaded a limited number of patient medical records and a user spreadsheet containing patient information. We found no evidence of any actual misuse of this information, but wanted to provide you with notice out of an abundance of caution.
What We Are Doing:
We want to assure you that we are taking steps to minimize the risk of this happening in the future. Since the incident, we have changed user passwords and implemented additional technical and security measures within our environment, among other measures.
Letters were mailed to impacted individuals for whom Blossom Health has addresses, which contained more information about the incident, complimentary credit monitoring and identity protection services, and steps individuals can take to protect themselves. We have no evidence that any of the information impacted by this incident has been misused, but we wanted to make you aware of this out of an abundance of caution.
We want to assure you that we are taking steps to minimize the risk of this happening in the future. Since the incident, we have changed user passwords and implemented additional technical and security measures within our environment, among other measures.
Letters were mailed to impacted individuals for whom Blossom Health has addresses, which contained more information about the incident, complimentary credit monitoring and identity protection services, and steps individuals can take to protect themselves. We have no evidence that any of the information impacted by this incident has been misused, but we wanted to make you aware of this out of an abundance of caution.
What You Can Do:
We encourage you to remain vigilant against incidents of identity theft by reviewing bank accounts, explanations of benefits (“EOBs”), and other financial statements. You can also visit the Federal Trade Commission’s website for more information on protecting your identity at consumer.ftc.gov/identity-theft-and-online-security.
We encourage you to remain vigilant against incidents of identity theft by reviewing bank accounts, explanations of benefits (“EOBs”), and other financial statements. You can also visit the Federal Trade Commission’s website for more information on protecting your identity at consumer.ftc.gov/identity-theft-and-online-security.
For More Information:
Individuals should contact 1-855-711-7845 Monday through Friday 8 am to 8 pm EST with any questions. Protecting personal information is of the utmost importance to Blossom Health, and we sincerely apologize for any concern this incident may cause.
Individuals should contact 1-855-711-7845 Monday through Friday 8 am to 8 pm EST with any questions. Protecting personal information is of the utmost importance to Blossom Health, and we sincerely apologize for any concern this incident may cause.
Get started
Questions?
Follow us
© 2026 Blossom Health
If you or someone you know is experiencing an emergency or crisis and needs immediate help, call 911 or go to the nearest emergency room. Additional crisis resources can be found here.
Get started
Questions?
Follow us
© 2026 Blossom Health
If you or someone you know is experiencing an emergency or crisis and needs immediate help, call 911 or go to the nearest emergency room. Additional crisis resources can be found here.
Get started
Questions?
Follow us
© 2026 Blossom Health
If you or someone you know is experiencing an emergency or crisis and needs immediate help, call 911 or go to the nearest emergency room. Additional crisis resources can be found here.