Three Oaks Hospice Data Breach: 36,622 People, No Lawsuit Filed Yet
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Three Oaks Hospice, a Dallas hospice group, found an intruder in its email on August 8, 2025 and told the public on September 17, 2026. The HHS Office for Civil Rights was told 36,622 people were affected. As of October 12, 2026 there is no Three Oaks Hospice data breach lawsuit on file that we could find — only law firms recruiting. No settlement, no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Three Oaks Says Happened
Three Oaks Hospice runs hospice, palliative and primary care through itself and sister companies Agape Hospice Care, Elevation Hospice of Colorado, Elevation Hospice of Utah and Sage Hospice, with locations in Arizona, Colorado, Georgia, Illinois, Kansas, Missouri, Pennsylvania, South Carolina and Texas.
Per its own notice, it discovered unauthorized activity in its email environment on August 8, 2025. HIPAA Journal reports that a limited number of email accounts were accessed by an unauthorized third party. Only on July 20, 2026 — almost a year later — did the investigation conclude that personal information was affected. Affiliated hospices were told on August 17, 2026, and the public notice followed on September 17, 2026.
The data that may be involved: names, dates of birth, driver license numbers, Social Security numbers, and medical and health insurance information. The company says not every element was present for every person and that it is unaware of any actual or attempted misuse.
Case Details
No data-breach complaint has been located. As of October 12, 2026, a federal docket search on CourtListener for “Three Oaks Hospice” returns only two matters, neither about the breach, and a search for the sister companies returns nothing filed since September 1, 2026. Federal dockets can lag, and state courts are not covered by that search, so a fresh filing could still surface.
The one federal case against the company, Mills v. Three Oaks Hospice Corporation, No. 3:25-cv-02807 in the U.S. District Court for the Northern District of Texas (Judge A. Joe Fish), was filed on October 15, 2025 — before the breach was announced — and is an ADA employment case. It has nothing to do with patient data.
Status: Breach Disclosed, No Lawsuit, No Settlement
An investigation is an advertisement for plaintiffs, not a case. If a Three Oaks Hospice data breach lawsuit is filed and later settles, class members would be notified by a court-appointed administrator — not by a law firm's web form.
Are You Affected?
You are likely affected if you received a letter from Three Oaks Hospice or one of its sister companies about this incident. The company says it is notifying all impacted individuals. Because hospice care often ends in a patient's death, letters may reach a family member or the estate — keep them either way.
The counts differ by source because each affiliate and location reported separately. HHS was told 36,622 people. In Texas, the Dallas filing on September 17, 2026 listed 3,034 Texas residents, Elevation Hospice of Utah 437, Three Oaks Hospice of Austin at least 327, and Three Oaks Hospice of West Houston 271 on September 21, 2026.
Not sure? Call the company's line: 1-800-610-8565, 7 a.m. to 7 p.m. Central, Monday to Friday. That number is from the official notice; some tracker sites print a different one.
Is There Money? Not Yet
For context only, not as a prediction: healthcare breach settlements usually split into reimbursement for documented losses and a smaller flat payment — and advertised maximums rarely match what people receive, as our analysis of six breach settlements shows. Our data breach settlement calculator shows what comparable cases paid.
Three Oaks Hospice Breach Timeline
- 1
August 8, 2025 — Email Intrusion Discovered
Three Oaks Hospice detects unauthorized activity in its email environment and starts an investigation.
- 2
July 20, 2026 — Personal Data Confirmed
The investigation concludes that the email activity affected personal information — almost a year after discovery.
- 3
August 17, 2026 — Affiliates Told
Three Oaks notifies its affected sister hospices, including Agape, Elevation and Sage.
- 4
September 17–21, 2026 — Public Notice and Texas Filings
The company posts its notice on September 17, 2026. Individual locations report to the Texas Attorney General between September 17 and 21.
- 5
Fall 2026 — HHS Count: 36,622
The HHS Office for Civil Rights is told that 36,622 people's health information was exposed.
- 6
October 12, 2026 — No Lawsuit on File
Law firms are recruiting, but no data-breach complaint has been located. No settlement, no claim form, no deadline.
Three Things to Watch For
Hospice breaches reach grieving families, which makes them easy targets:
“Claim your Three Oaks settlement” forms
There is no settlement to claim. Pages saying “submit a claim today” are law-firm or lead-generation forms, not a claims process. Do not enter a Social Security number to “check eligibility.”
Calls about a late relative's hospice bill
The exposed records include insurance and medical details of hospice patients. A caller who knows your relative's name and care dates can sound official. Hang up and call the number on the notice letter.
A different phone number for the call center
Some tracker sites list a number that does not match the official notice. Use only 1-800-610-8565 from the company's own notice, and never pay a fee to learn whether you were affected.
Three Oaks Hospice Breach — Questions People Ask
Is there a Three Oaks Hospice data breach lawsuit?
Not that we could find as of October 12, 2026. Law firms are advertising investigations, but no data-breach complaint has been located in federal dockets. The only federal case against the company, Mills v. Three Oaks Hospice Corporation (No. 3:25-cv-02807, N.D. Texas), is an ADA employment case filed in 2025.
What happened in the Three Oaks Hospice data breach?
An unauthorized party got into company email accounts. Three Oaks discovered it on August 8, 2025, confirmed on July 20, 2026 that personal information was affected, and announced it on September 17, 2026.
How many people were affected?
36,622, per the figure reported to the HHS Office for Civil Rights. Texas filings break out residents by location: 3,034 for Dallas, 437 for Elevation Hospice of Utah, at least 327 for Austin and 271 for West Houston.
What information was exposed?
Names, dates of birth, driver license numbers, Social Security numbers, and medical and health insurance information. Not every element was present for every person; your letter says which applied to you.
Is there a settlement amount or payout date?
No. With no lawsuit filed, there is no settlement, no fund, no payout date and no claim form. Any figure you see is a guess.
Can you sue a hospice or hospital for a data breach?
Patients can bring their own claims, and data-breach class actions against healthcare providers are common. Here, as of October 12, 2026, attorneys are only investigating. If a class action is filed and settles, you would not need your own lawyer to be included.
Why did it take so long to notify people?
The company says its investigation ran from August 8, 2025 until July 20, 2026 before it concluded personal data was involved. It has not explained the length further. Delay is a common theme in breach lawsuits, but none has been filed here yet.
What should I do now?
Keep the notice letter. Freeze your credit at all three bureaus. Read health insurance and Medicare statements for services nobody received. If you handle a deceased patient's affairs, ask the bureaus to flag the record as deceased.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements taking claims right now, with deadlines
Data Breach Settlement Calculator
What breach settlements have actually paid per person
Change Healthcare Data Breach
The largest healthcare breach litigation and where it stands
Settlement Payout Calculator
Estimate a per-person share once a fund exists