25% off all training courses Offer ends May 29, 2026
View HIPAA Courses
25% off all training courses
View HIPAA Courses
Offer ends May 29, 2026

The HIPAA Journal is the leading provider of HIPAA training, news, regulatory updates, and independent compliance advice.

Data Breach Affects Patients of Multiple Fyzical Therapy & Balance Centers

Fyzical Acquisition Holdings LLC, the parent company of Fyzical Therapy & Balance Centers, has announced a security incident involving unauthorized access to the personal and protected health information of its patients.

Fyzical Therapy & Balance Centers is a large physical therapy franchise with more than 500 locations in 46 U.S. states. On or around December 9, 2024, suspicious activity was identified within its email environment. An investigation was launched to determine the cause of the activity, and it was confirmed that there had been unauthorized access to its email environment.

The substitute data breach notice does not state for how long its email environment was compromised, only that during that time, emails and attached files may have been viewed or acquired. The review of the affected data has taken almost a year to complete, concluding on November 25, 2025, when it was confirmed that the affected data included names, dates of birth, Social Security numbers, driver’s license numbers, state IDs, financial account information, credit card information, medical information, and health insurance information. The types of data involved varied from individual to individual.

In response to the breach, data privacy and security policies and procedures have been reviewed and enhanced to reduce the likelihood of similar incidents in the future. Individual notification letters have been mailed to the affected individuals, and complimentary credit monitoring and identity theft protection services have been offered.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The scale of the data breach is currently unclear as the incident is not currently shown on the HHS’ Office for Civil Rights website. Attorneys general in multiple states have been notified, indicating the data breach is nationwide. The Texas Attorney General has been informed that up to 1,801 Texas residents have been affected, but other state attorneys general have yet to confirm how many state residentshave been affected.

Author: Steve Alder is the editor-in-chief of The HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist