July 16, 2026: Lifespan Physician Group of Massachusetts, Inc.—doing business as Brown Health Medical Group-MA—reported a healthcare data breach to Massachusetts regulators as OCA filing 2026-1151. The Commonwealth’s 2026 breach report lists 290,357 Massachusetts residents affected, with flags for Social Security numbers, medical records, financial accounts, driver’s licenses, and credit/debit card numbers.
Vermont’s board shows another 86 residents for the same legal entity. That is already a multi-state floor above 290,400 people—before any unpublished out-of-state totals.
What we know from filings
The Massachusetts 2026 Data Breach Notification Report is the primary count source. Public summaries do not yet spell out how attackers got in, when access started, or when the organization discovered it. July 16 is the reporting/notice date, not necessarily the intrusion date.
ClassAction.org and other plaintiff firms cite the Vermont AG notice for data categories (SSNs, financial account codes, payment cards, government IDs, health records) and note that category exposure can vary person to person.
Why the two names
Lifespan Physician Group of Massachusetts is the legal filer. Brown Health Medical Group-MA is the public brand after Lifespan’s rebrand toward Brown University Health. Same organization, different labels on the letterhead.
Medical identity theft is the real risk
When SSN and clinical data travel together, fraud is not only new credit cards—it is fake claims on your insurance, polluted charts, and phishing that pretends to be your clinic’s billing desk.
What you should do
- If you got a Brown Health / Lifespan Physician Group notice, keep it and follow any monitoring enrollment steps.
- Freeze credit at all three bureaus; monitor tax transcripts for unexplained filings.
- Review EOBs, patient-portal visits, and pharmacy history for unfamiliar providers or prescriptions.
- Ignore unexpected “breach help desk” calls asking for passwords or payment.
- Canonical record: Brown Health Medical Group-MA 2026 on BreachHistory.
Sources: Massachusetts OCA 2026 breach report; Vermont AG security breach notices; ClassAction.org.