Doctor's Choice Home Care discloses data breach tied to WellSky vendor

Doctor’s Choice Home Care & Hospice, a Houston-based home health and hospice provider, disclosed a data breach affecting 14,333 Texas residents after an unauthorized party gained access to a clinical user account within the electronic medical record system operated by its vendor, WellSky.

The company said an unauthorized party used compromised credentials to access a single clinical user account within the WellSky system between June 5 and July 24, 2026, and that it discovered the incident on July 21. Doctor’s Choice said its chief technology officer confirmed that account was the only point of unauthorized access, and that a review of the company’s own internal systems and networks found no related unauthorized activity, isolating the breach to the WellSky platform.

The information potentially exposed included names, addresses, dates of birth, Social Security numbers, scheduling information, clinical and treatment information, and health insurance information. The breach was reported to the Texas attorney general’s office on Sept. 21, and affected individuals were notified by U.S. mail and through a notice on the company’s website.

Doctor’s Choice said it disabled the affected account upon learning of the incident, worked with WellSky to confirm the scope of access, and is continuing to work with the vendor to strengthen its security controls. The company said it notified the Houston Police Department, which has an active case assigned to investigate. Doctor’s Choice said it is not aware of any confirmed misuse of the exposed information but is offering patients free credit monitoring as a precaution.

The company directed affected individuals to request free credit reports from the three nationwide credit bureaus under the Fair Credit Reporting Act and provided contact information for Equifax, Experian and TransUnion. It also recommended that patients review their explanation-of-benefits statements and medical bills for unfamiliar charges, watch for suspicious account activity, be cautious of unsolicited requests for personal information, and report any signs of identity theft to the Federal Trade Commission. Individuals with questions can contact Kristin Glover, the company’s chief compliance officer and privacy officer, through a toll-free number or by mail.