zHealth EHR Data Breach Investigation

A cybersecurity incident at zHealth, a San Francisco based electronic health records company, has allegedly put the medical information of over a million patients at risk.

The company began notifying affected individuals on September 10, 2026, more than seven months after the breach actually occurred, raising serious questions about how long consumers were left in the dark.

Contact our data breach lawyers to learn more about taking legal action.

What happened at zHealth?

zHealth provides practice management and EHR software for wellness providers such as chiropractors, physical therapists, massage therapists and acupuncturists.

According to the company's own notice, an unauthorized third party accessed its network between January 20 and January 21, 2026. zHealth says it did not discover the intrusion until June 15, 2026, and did not begin sending notification letters until September.

What data was exposed?

The breach reportedly compromised medical information and health insurance details. A threat actor operating under the alias "Kazu" claimed on the dark web to have stolen roughly 15 gigabytes of data, including more than 1.2 million records containing clinical notes, appointment details and billing information.

Under California law, businesses that experience a breach involving unencrypted personal information must notify affected residents without unreasonable delay. A gap of several months between discovery and notification can leave patients unaware that their health data may already be circulating and being misused.

What patients can do now

• Read any notification letter from zHealth carefully and keep a copy
• Monitor insurance statements and medical bills for unfamiliar charges
• Place a fraud alert or credit freeze with the major credit bureaus
• Watch for phishing attempts referencing your medical provider

Why contact The Lyon Firm?

Health data breaches expose sensitive medical records and insurance details that can be used for years to commit medical identity theft and insurance fraud.

The Lyon Firm has represented millions of individuals and proposed classes in data breach litigation nationwide and understands the notification and liability standards that apply to healthcare technology vendors.

If your information may have been part of the zHealth breach, our attorneys can explain your legal options and pursue compensation on your behalf at no upfront cost. Contact The Lyon Firm today for a free consultation.