Nephrology Associates Medical Group Data Breach Lawsuit Investigation, What California Patients Need to Know
Nephrology Associates Medical Group, a kidney care practice serving California’s Inland Empire, publicly disclosed a data breach on February 27, 2026, affecting current and former patients. The company determined on December 2, 2025 that an unauthorized individual had accessed its network on or about May 20, 2025 and acquired files containing protected health information belonging to patients, including Social Security numbers, medical records, health insurance details, and billing information.
No lawsuit has been filed in court as of this writing, but at least two law firms have announced investigations into potential class action claims on behalf of affected patients.
Quick Facts
- Incident Type: Healthcare data breach — unauthorized network access and file acquisition
- Company: Nephrology Associates Medical Group (NAMG)
- Location: Riverside, California (Riverside and San Bernardino counties)
- Breach Discovered: May 20, 2025
- Breach Confirmed: December 2, 2025
- Public Notification Date: February 27, 2026
- Data Exposed: Names, Social Security numbers, dates of birth, medical or health information, healthcare treatment or diagnostic information, health insurance information, billing or payment information, and credentialing information
- Lawsuit Filed: No — pre-litigation investigation stage as of March 4, 2026
- Investigating Law Firms: Shamis & Gentile P.A.; The Lyon Firm
- Settlement / Claim Deadline: None — no settlement exists yet
- NAMG Contact: (844) 443-1521 — Monday–Friday, 6:30 a.m. to 3:30 p.m. PT
- Official Sources: NAMG Press Release | namg.net
Current Status and What Happens Next
This matter remains at the pre-litigation investigation stage. No formal complaint has been filed in any federal or state court as of March 4, 2026. Here is what consumers should watch for:
- No lawsuit filed yet — attorneys are currently gathering information from affected patients to assess whether viable class action claims exist.
- Notification letters being sent — Nephrology Associates issued its public notification on February 27, 2026, and has established a toll-free call center reachable at (844) 443-1521, available Monday through Friday, 6:30 a.m. to 3:30 p.m. PT.
- Complaint filing — if attorneys determine viable claims exist, a formal class action complaint may be filed in California state or federal court within the coming weeks or months.
- No claim form or settlement website exists yet — affected patients cannot file a claim or seek compensation through any official process at this time.
- Timeline to watch — most healthcare data breach class actions take 12 to 30 months from filing to resolution; a settlement, if reached, would come after that process begins.
What the Breach Involves — Background and Timeline
On May 20, 2025, Nephrology Associates Medical Group discovered suspicious activity within its network. The company quickly secured its systems and launched an investigation with the help of cybersecurity experts. The investigation determined that an unauthorized individual accessed the network and acquired files, some of which contained protected health information belonging to patients.
What followed was a lengthy forensic review that stretched across the summer and fall of 2025. It was not until December 2, 2025 that the organization confirmed patient health information had likely been compromised, and the formal public notification did not come until February 27, 2026 — a timeline of roughly nine months from discovery to public disclosure.
As of the date of the public notice, there is no evidence that the exposed information has been misused, but the risk remains. Medical identity theft frequently operates on a slow timeline, with fraudulent activity sometimes emerging months or years after an initial breach. Patients should remain vigilant even if no suspicious activity has appeared on their accounts to date.
What Information Was Compromised
The data exposed in the Nephrology Associates breach includes names, Social Security numbers, dates of birth, medical or health information, healthcare treatment or diagnostic information, health insurance information, billing or payment information, and credentialing information.
The combination of Social Security numbers, detailed medical records, health insurance data, and billing information is particularly significant. This type of data set enables identity theft, fraudulent insurance claims, and medical identity theft — where a bad actor uses another person’s insurance to seek care or prescription medications. Unlike financial account numbers, Social Security numbers cannot be changed, making their exposure a long-term risk for affected individuals.
Who Could Be Affected
Nephrology Associates Medical Group is a nephrology practice serving Riverside and San Bernardino counties in California’s Inland Empire. The group has more than 40 years of experience treating patients with kidney and related diseases and operates 16 offices, a network of dialysis units, and provides care at several hospitals throughout the region.
Any current or former patient of Nephrology Associates Medical Group who received a notification letter from the organization may be within the affected group. The total number of individuals affected has not been publicly disclosed by NAMG at this time. Patients who are unsure whether they received a notice should contact the NAMG call center at (844) 443-1521.
What Any Future Lawsuit Would Likely Allege
No complaint has been filed and no formal allegations exist in court. However, data breach class actions against healthcare providers in similar circumstances typically allege negligence — that the organization failed to implement reasonable cybersecurity measures to protect sensitive patient data entrusted to it.
The timeline — roughly nine months from discovery to public disclosure — deserves scrutiny, as HIPAA’s Breach Notification Rule generally requires covered entities to notify affected individuals without unreasonable delay and within 60 days of discovering a breach. Whether NAMG’s notification timeline complied with HIPAA and California law may be a central issue in any litigation that follows.
Additional potential legal theories in cases of this type include breach of implied contract, unjust enrichment, invasion of privacy, and violations of the California Consumer Privacy Act (CCPA) and California Confidentiality of Medical Information Act (CMIA). California’s CMIA provides patients with a private right of action for unauthorized disclosure of medical information, with statutory damages of up to $1,000 per violation regardless of actual harm, plus punitive damages in cases of willful or negligent disclosure. No court has made any findings against Nephrology Associates, and the organization has not admitted any wrongdoing.
What NAMG Says It Is Doing
Nephrology Associates Medical Group has stated that it is taking additional steps to improve security, including implementing stronger password requirements, more frequent password changes, reduced access permissions, and offline storage of older data.
These are reasonable remediation steps, but they address future security rather than protecting patients whose data has already been taken. Reactive security upgrades benefit future patients, not those already harmed by the incident.
Similar Cases — How Healthcare Data Breach Lawsuits Typically Resolve
A closely related case provides useful context. Hypertension Nephrology Associates (HNA) in Willow Grove, Pennsylvania, agreed to pay $625,000 to settle a class action lawsuit stemming from a January 2024 data breach in which a ransomware actor breached its network and stole the personal and protected health information of 39,491 patients, including health and financial information.
The HNA settlement fund covered attorneys’ fees, administration costs, and class member benefits. Class members could submit a claim for reimbursement of documented out-of-pocket losses up to $5,000 per class member, or alternatively claim a one-time cash payment. Regardless of the option chosen, all class members could also claim two years of credit monitoring and insurance services.
The HNA case illustrates the typical structure of healthcare data breach settlements — documented loss reimbursement, an undocumented cash option, and credit monitoring — and gives affected Nephrology Associates patients a reasonable benchmark for what relief a future settlement might provide, if litigation is filed and resolved.
What to Do Right Now If You Received a Notification Letter
If you received a notification letter, act immediately. Place fraud alerts with all three major credit bureaus, review your Explanation of Benefits statements for any medical services you did not receive, and consider a free credit freeze.
Here are the concrete steps to take today:
- Contact NAMG’s call center at (844) 443-1521, Monday–Friday, 6:30 a.m. to 3:30 p.m. PT, with any questions about the breach or your specific information.
- Place a free fraud alert with any one of the three major credit bureaus — Equifax, Experian, or TransUnion. A fraud alert requires creditors to verify your identity before opening new accounts and is automatically shared among all three bureaus.
- Consider a free credit freeze at all three bureaus, which prevents new credit accounts from being opened in your name entirely.
- Review Explanation of Benefits (EOB) statements from your health insurer for medical services, prescriptions, or procedures you did not receive.
- Get your free credit reports at AnnualCreditReport.com and review all accounts and inquiries.
- Report any identity theft to the FTC at IdentityTheft.gov and to your local law enforcement.
- Keep your notification letter — it may serve as proof of eligibility if a class action settlement is reached in the future.
Frequently Asked Questions
Has a lawsuit been filed against Nephrology Associates Medical Group?
No. As of March 4, 2026, no formal lawsuit has been filed in any court. Shamis & Gentile P.A. is currently investigating the Nephrology Associates Medical Group data breach and exploring potential class action claims on behalf of affected patients. The Lyon Firm is also investigating. A lawsuit may or may not be filed in the coming months.
Who was affected by the Nephrology Associates data breach?
Nephrology Associates Medical Group determined on December 2, 2025 that a data security incident involving unauthorized network access may have exposed the protected health information of certain patients. Current and former patients who received a notification letter are likely within the affected group. The total number of affected individuals has not been publicly disclosed.
What data was exposed in the Nephrology Associates breach?
The information exposed includes names, Social Security numbers, dates of birth, medical or health information, healthcare treatment or diagnostic information, health insurance information, billing or payment information, and credentialing information.
Is there a settlement or claim form I can file right now?
No. There is no settlement, no official settlement website, and no claim deadline at this time. A class action must first be filed and litigated before any claim period opens. Check back for updates as this matter develops.
Why did it take nine months from breach discovery to public notification?
Nephrology Associates Medical Group discovered suspicious activity on May 20, 2025, promptly secured its environment, and launched an investigation with cybersecurity experts. The company determined on December 2, 2025 that certain patient information may have been compromised. The formal public notification followed on February 27, 2026. HIPAA’s Breach Notification Rule generally requires notification within 60 days of confirming a breach. Whether NAMG’s overall timeline met applicable legal requirements may be addressed in any future litigation.
What is Nephrology Associates Medical Group?
Nephrology Associates Medical Group is a kidney care practice serving Riverside and San Bernardino counties in California’s Inland Empire with more than 40 years of experience treating patients with kidney and related diseases. It operates 16 offices, a network of dialysis units, and provides care at several hospitals throughout the region.
What California laws may apply to this breach?
California patients have specific protections beyond federal HIPAA law, including the California Confidentiality of Medical Information Act (CMIA), which provides a private right of action for unauthorized medical data disclosures, and the California Consumer Privacy Act (CCPA). These laws may form the basis of state-specific legal claims in any future class action filed on behalf of California patients.
Last Updated: March 4, 2026
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah