Paradigm Healthcare notifies 970,000 Medi-Cal members 11 months after detecting breach

Paradigm Healthcare Services detected unauthorized access to its local network on Oct. 13, 2025, but did not confirm compromised files until Aug. 18, 2026. The company began notifying about 970,000 Medi-Cal members on Sept. 14, 2026, nearly 11 months after it detected the intrusion. The delay exceeds HIPAA’s 60-day outer bound and raises regulatory exposure questions.

Paradigm reported the breach to the US Department of Health and Human Services Office for Civil Rights, as required for breaches affecting 500 or more individuals. The breach will appear on the HHS public breach portal, subjecting Paradigm to regulatory scrutiny.

Paradigm’s 11-month delay exceeds this requirement, exposing it to regulatory penalties. The delay raises regulatory exposure and questions about Paradigm’s incident response capabilities.

The potentially accessed files include names, dates of birth, gender, and Medi-Cal member identification numbers for those members. Medi-Cal is a state-run healthcare program serving low-income residents.

California regulators are scrutinizing the breach because of its impact on Medi-Cal, a state-run healthcare program serving low-income residents. Paradigm’s Data Use Agreement with the California Department of Health Care Services grants it access to Medi-Cal member identification numbers for billing purposes. The breach exposes risks in third-party data handling under state contracts.

Third-party vendors like Paradigm pose significant risks to healthcare data security, as their breaches can expose large populations relying on public health programs. California school districts and Local Educational Agencies rely on Paradigm for Medi-Cal billing, making them indirectly affected by the breach. The breach impacts not only Medi-Cal members but also the educational institutions dependent on Paradigm’s services.

After detecting the intrusion, Paradigm took systems offline, notified law enforcement, and engaged outside incident response experts to investigate the breach. Still, the company did not identify the threat actor, explain the attack method, or confirm whether data was exfiltrated. No known cybercrime group has claimed responsibility for the breach. Paradigm’s Student Health Network, an online billing and documentation platform, was not affected.

Common attack vectors in healthcare vendor breaches include exposed web applications, weak multifactor authentication, and credential stuffing, in which attackers use stolen username-and-password pairs to enter accounts. The breach exposed Medi-Cal member identification numbers, increasing risks of medical identity theft and fraudulent claims under affected individuals’ identities.

Paradigm asserts no evidence that anyone used exposed information for fraud or identity theft, though it advises affected individuals to monitor for suspicious activity. The company’s notice tells members, “We have no evidence that any of your information has been used to commit fraud or identity theft as a result of this incident.” Paradigm advises affected individuals to monitor credit reports, watch for medical or insurance fraud, and avoid phishing attempts using exposed personal details.

The HHS breach tracker lists the Paradigm incident alongside recent incidents at Tarter Krinsky & Drogin, affecting 196,000 people, and Ridgeway Pharmacy, affecting 258,000 people. California’s breach notification statute, Civil Code section 1798.82, imposes additional obligations on entities handling personal information, including Medi-Cal data. The state law may subject Paradigm to further scrutiny or penalties beyond federal HIPAA requirements.