By HFT Staff

On or around September 16, 2025, Heritage Holdings LP, “Heritage”, operating as a business associate of Heritage Communities, Orchard Pointe, and OnCare Health; experienced a network intrusion that affected a limited number of systems. Upon discovery, Heritage took immediate action to secure its network and investigate the event. This included engaging a third-party team of forensic experts to investigate the incident and determine the full nature and scope of the event. Following a thorough investigation, Heritage has confirmed that a limited amount of protected health information may have been subject to unauthorized access in connection with this incident.  

Although the forensic investigation could not rule out the possibility that an unknown actor may have accessed this information, there is no indication whatsoever that any information has been misused at this time. The type of information contained within the affected data included first and last name, in combination with one or more of the following: social security number, driver’s license number, bank account information, credit card information, date of birth, address, phone number, email, medication information, healthcare diagnosis information, test results, healthcare provider information. Importantly, the information potentially impacted may vary for each individual, and may include all, or just one of the above-listed types of information.  

At this time, Heritage is not aware of any evidence to suggest that patient information has been misused. However, Heritage has been unable to rule out the possibility that the patient information could have been accessed. Therefore, in an abundance of caution, Heritage is partnering with third party specialists to perform a thorough analysis of the affected information to identify and subsequently notify all potentially affected individuals as required by law. 

In response to this incident, Heritage has implemented additional security measures within its network and facilities and is reviewing its current policies and procedures related to data security.