What to Do After the DC Health Care Finance Data Breach (2026)

If you were enrolled in DC Medicaid or the DC Healthcare Alliance between 2023 and July 2026, your Medicaid ID, date of birth, provider name, race, gender and ward may have been exposed in two reports published on the DHCF website. About 399,086 people are affected. No names or SSNs leaked, but medical fraud and scam calls are real risks.

What Happened

On July 21, 2026, the District of Columbia Department of Health Care Finance (DHCF) — the agency that runs DC Medicaid and the DC Healthcare Alliance — discovered that two reports posted on its own website exposed beneficiary data. Only aggregate statistics appeared on screen, but the underlying personal records that produced those numbers sat in hidden fields inside the files, where anyone who downloaded them could read them.

This was not a hack. No ransomware group broke in and nobody had to defeat a security control; the data was published by mistake. DHCF reported the incident to the US Department of Health and Human Services Office for Civil Rights on September 3, 2026 as a reportable HIPAA breach affecting 399,086 individuals, and began mailing individual notices.

What Data Was Exposed

• Medicaid ID number
• Date of birth
• Provider name — which can imply what kind of care you received
• Race, ethnicity and gender
• Ward — your area of the District

According to DHCF, the exposed data did not include beneficiary names, Social Security numbers or financial account information. That materially lowers the risk of someone opening a credit card in your name off this breach alone.

Why "No Names or SSNs" Is Not the Same as "No Risk"

Two things make this breach more dangerous than the field list suggests.

First, your name is already public. Data brokers and people-search sites publish names tied to addresses, dates of birth, phone numbers, ages and relatives — legally, and indexed by Google. A Medicaid ID plus a date of birth plus a ward is a short search away from a full identity when the matching name and address can be bought for a few dollars. Re-identification is the whole business model of the broker industry.

Second, a Medicaid ID is a medical credential. Medical identity theft is used to obtain care, prescriptions and equipment in someone else's name, and it is harder to detect than credit fraud because the paperwork lands with providers and plans rather than on your credit report.

Step 1: Confirm Whether You Were Affected

Watch your physical mail for the DHCF notice. If you were enrolled between 2023 and July 2026 and nothing arrives — or you have moved since — call 1-833-687-5424 and ask directly. Check the official incident page on dhcf.dc.gov rather than following a link from an email.

Step 2: Review Every Explanation of Benefits

This is the single most useful thing you can do, and almost nobody does it. Read each Medicaid or Alliance statement you receive and look for:

• Appointments, procedures or tests you never had
• Providers or facilities you have never visited
• Prescriptions, medical equipment or supplies you never received
• Claims dated while you were out of town or in hospital elsewhere

Report anything unfamiliar to DHCF and to your managed care plan immediately. You can also request a copy of your medical records from any provider that appears on a claim you do not recognise, and ask for an accounting of disclosures.

Step 3: Freeze Your Credit Anyway

No Social Security numbers were exposed here, so credit fraud is not the primary risk — but freezing your credit is free, takes about 15 minutes, and protects you against every breach, including the ones that did expose SSNs. Freeze at all three bureaus: Equifax, Experian and TransUnion. Then freeze the secondary bureaus fraudsters use to route around the big three: Innovis, ChexSystems, NCTUE and the Work Number. A freeze blocks new-account fraud outright, which no monitoring alert can do.

Step 4: Guard the Identifiers That Were Exposed

• Treat your Medicaid ID like a credit card number. Do not read it out to an inbound caller, and do not post photos of your card or statements.
• Ask DHCF about a new ID number if you see fraudulent claims. Replacing a compromised identifier is the medical equivalent of a card reissue.
• Set up account alerts with your managed care plan so you are told when claims are filed.
• Keep the notice letter. If you later need to dispute fraudulent care, documentation that your data was exposed in a known breach helps.

Step 5: Cut the Public Half of Your Profile

You cannot un-publish the DHCF reports, and you cannot change your date of birth. What you can change is the other half of the equation — the openly published name, address, phone number and relatives that let a stranger turn a leaked Medicaid ID into a convincing phone call or a usable identity.

PrivacyOn removes your personal information from 100+ data brokers and people-search sites, verifies each removal, and keeps monitoring so you are re-removed when a broker republishes your profile. Every plan includes dark web monitoring, so you are alerted if your details surface in breach data or on underground marketplaces, and family plans cover up to 5 people from $8.33/month — worth doing if several people in your household were on Medicaid or Alliance coverage. Start with a free exposure scan to see what is public about you right now.

How to Complain or Escalate

• DHCF: 1-833-687-5424 for questions about your notice or to report suspected fraud on your coverage
• HHS Office for Civil Rights: file a HIPAA complaint at ocrportal.hhs.gov if you believe your health information was mishandled
• DC Attorney General: oag.dc.gov or 202-727-3400, for consumer protection concerns
• FTC: report identity theft at identitytheft.gov, which generates a recovery plan and an official affidavit

Frequently Asked Questions

How many people were affected by the DC Health Care Finance data breach?

DHCF reported 399,086 affected individuals to the HHS Office for Civil Rights. The exposure covers Medicaid and DC Healthcare Alliance beneficiaries enrolled between 2023 and July 2026, and the agency is notifying affected people by mail.

Were Social Security numbers exposed in the DHCF breach?

No. According to DHCF, the exposed data did not include names, Social Security numbers or financial account information. It included Medicaid ID numbers, dates of birth, provider names, race, ethnicity, gender and ward. That lowers credit-fraud risk but still supports medical identity theft and targeted scams.

What should I do first if I got a DHCF breach notice?

Review your Explanation of Benefits statements for care you never received, report anything unfamiliar to DHCF and your managed care plan, freeze your credit at all three bureaus for free, and treat any inbound call about the breach as a scam until you have called 1-833-687-5424 yourself.

Is DHCF offering free credit monitoring?

DHCF's public notice focuses on mailed notifications and its toll-free information line rather than announcing a credit monitoring offer. Read your own letter carefully — if monitoring is included, the enrollment code and deadline will be in it. Do not wait on it either way: credit freezes are free and stronger than monitoring.

Can my data be misused if my name was not exposed?

Yes. Names, addresses, ages and relatives are already published by data brokers and people-search sites, so a date of birth and a ward are often enough to match a leaked record to a real person. Removing your broker listings is the practical way to break that link — PrivacyOn covers 100+ sites with verified removals and ongoing monitoring from $8.33/month.

How do I spot medical identity theft?

Watch for Explanation of Benefits statements listing care you did not receive, calls from debt collectors about medical bills you do not recognise, denials of coverage because you supposedly reached a benefit limit, or unfamiliar conditions in your medical records. Request your records from any provider you do not recognise and dispute errors in writing.

Does deleting data from broker sites help after a health data breach?

It does not undo the breach, but it removes the lookup layer attackers rely on. Exposed health identifiers become dangerous when they can be matched to your name, current address and phone number — which is exactly what people-search sites publish. PrivacyOn removes that information from 100+ sites, re-removes you when brokers relist you, and includes dark web monitoring in every plan.