Conifer Value-Based Care, LLC

Conifer Value-Based Care, LLC reported that an unauthorized third party gained access to an employee's Microsoft Office 365 business email account on August 28-29, 2025. The incident involved personal information of patients and guarantors, potentially including names, addresses, and health-related data, but excluded SSNs, financial accounts, and passwords. Conifer contained the threat, launched an investigation, and notified affected healthcare providers and plans. No misuse of information was reported.

Conifer Value-Based Care, LLC (a Business Associate, TX) reported to HHS on 2025-12-18 a Hacking/IT Incident affecting 12,206 individuals. Several employees were targets of an email phishing scheme that compromised PHI including clinical, demographic, and financial information. Breached information located on Email. The BA notified HHS, affected individuals, and media, provided substitute notice, offered credit monitoring, implemented additional safeguards, and retrained workforce members.

Affected (this filing): 12,206