University of Iowa Community HomeCare Data Breach Lawsuit Investigation
Were you one of the 210,000 patients notified about the University of Iowa Community HomeCare data breach? An unauthorized cyber-intrusion may have exposed your Social Security number, medical records and other highly sensitive details. Find out how to protect yourself and whether you can pursue compensation.
Download Breach Notice (PDF)What Happened?
On July 3, 2025 an attacker gained unauthorized entry into University of Iowa Community HomeCare’s (UI Community HomeCare) computer network. Internal investigators later determined the intruder viewed or copied files containing personal identifiable information (PII) and protected health information (PHI).
UI Community HomeCare—a University of Iowa Health Care affiliate that provides home infusion therapy and medical equipment—operates three locations serving Iowa, western Illinois and northern Missouri. The breach notice states that, after discovering the incident, the company secured its systems and launched a forensic investigation to understand the scope of the compromise.
Data Exposed
The categories of information that may have been accessed vary by individual, but could include:
- Full name
- Social Security number
- Mailing address & phone number
- Date of birth
- Medical data (medical record number, providers, dates of service, visit type)
- Health-insurance information
Who Is Affected?
UI Community HomeCare has confirmed that approximately 210,720 current and former patients and customers are at risk. Notification letters were mailed beginning August 29, 2025, and an online breach notice lists the specific data sets involved for each person.
How to Protect Yourself
- Enroll in any complimentary credit or identity-monitoring services offered in the breach letter.
- Place a fraud alert or credit freeze with the major credit bureaus.
- Monitor explanation-of-benefits (EOB) statements and medical bills for unfamiliar services.
- Change passwords for patient portals and email accounts tied to your medical providers.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov.
Possible Legal Claims
Organizations that store personal and medical data have a legal duty to safeguard that information. When a data breach occurs because of insufficient security measures, affected individuals may be able to:
- Seek compensation for out-of-pocket expenses (credit monitoring, account fees, etc.).
- Recover damages for time spent addressing fraud and loss of privacy.
- Pursue stronger injunctive relief requiring the company to implement enhanced security protocols.
Why Timely Action Matters
Data-breach statutes of limitation differ by state and can be as short as one year. Acting quickly preserves your right to join any class action or individual lawsuit that may arise.
Frequently Asked Questions
What caused the University of Iowa Community HomeCare data breach?
The company reported that an unauthorized individual infiltrated its network on July 3, 2025. The specific vulnerability exploited has not yet been disclosed.
How do I know if my data was involved in the University of Iowa Community HomeCare breach?
If you received a mailed notification dated on or after August 29, 2025—or you were a patient or customer before that date—your data could be at risk. You can also review the online breach notice linked above.
What information was exposed in the University of Iowa Community HomeCare incident?
Potentially exposed data includes names, Social Security numbers, contact details, dates of birth, health-insurance data and certain medical records.
Can I file a lawsuit against University of Iowa Community HomeCare?
Possibly. Victims of data breaches often sue for negligence, breach of implied contract and violations of state privacy statutes. Consult an experienced data-breach attorney to evaluate your claim.
Will University of Iowa Community HomeCare pay for identity-theft protection?
According to its notice, the company is offering complimentary monitoring services. The quality and duration of these services can factor into any legal claim for additional relief.
Next Steps
If you were notified—or suspect you were affected—consider speaking with counsel specializing in health-care data breaches. Gathering your breach letter, a government-issued ID and any evidence of fraud will expedite the evaluation of your case.
This article is for informational purposes only and does not constitute legal advice.