San Bernardino County Breach: What ARMC Patients Need to Know

San Bernardino County, operating Arrowhead Regional Medical Center (ARMC), recently announced a data security breach that occurred on August 28, 2026. The official filing with the California Attorney General's office was made on September 28, 2026, confirming that sensitive personal and health information was compromised. The full extent and mechanics of the intrusion are still under investigation, with the county currently monitoring the situation.

The compromised data types in this breach include Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates. This combination of identifying and medical data is highly sensitive and can lead to significant concerns for affected individuals.

When information like your Social Security Number, Date of Birth, and Medical Record Number is exposed, the risk of identity theft and financial fraud increases. Malicious actors could attempt to open new accounts, file fraudulent tax returns, or gain unauthorized access to existing financial services. Furthermore, the exposure of Diagnosis and Treatment Information, Prescription Information, and Health Insurance ID Numbers can lead to medical identity theft, where someone might use your identity to obtain healthcare services, potentially corrupting your medical records and affecting future care.

Under federal laws like HIPAA and HITECH, as well as California's specific data privacy regulations, entities like San Bernardino County and ARMC are legally obligated to protect patient data with robust security measures. A breach of this nature suggests that these safeguards may not have been sufficient, potentially indicating a failure in their duty to secure your confidential information.

Receiving a data breach notification letter from San Bernardino County regarding Arrowhead Regional Medical Center is a formal acknowledgement that your private data was compromised. This notification establishes your standing to seek legal recourse. You do not need to prove that you have already suffered financial or medical harm to consider your options; the increased risk of future identity theft and the burden of monitoring your information are recognized legal injuries. Our firm is investigating this data breach, and we offer free case reviews to help you understand your legal rights and potential next steps.