Hazard nonprofit health provider discloses data breach, patient records at risk

Kentucky Mountain Health Alliance disclosed in June 2026 that unauthorized access to patient information may have exposed Social Security numbers, driver’s license details and medical records at the Hazard nonprofit that serves Perry County and surrounding communities. The organization said some data may have been copied during the incident, and affected patients were told by mail.

That warning lands hard in Hazard, where Kentucky Mountain Health Alliance is part of the basic healthcare safety net. The nonprofit said it was formed in 2005 and began serving as a single point of entry for the Healthcare for the Homeless program, Little Flower Clinic and Rotary Free Clinic services. Its mission is to improve the health and well-being of underserved Southeastern Kentucky residents and people at risk for homelessness.

The Little Flower Clinic, at 279 East Main Street in Hazard, offers patient-centered medical home care that includes preventative and wellness visits, acute care and chronic disease management. For many patients who already face transportation problems, cost barriers and limited provider options, records tied to that care can carry sensitive information about identity, billing and treatment history.

A Massachusetts notice letter said Kentucky Mountain Health Alliance mailed notification letters to affected individuals and arranged a complimentary two-year identity monitoring membership through Epiq. The available notices did not disclose how many people were affected, and no specific threat actor had been identified. That leaves patients with a privacy question that is both personal and practical: whether their information, once inside a medical chart, may now be vulnerable to misuse outside the clinic.

The breach also underscores how exposed small rural health systems can be when they hold a large share of a community’s primary care and support services. In a place like Perry County, where one nonprofit can connect homeless services, routine care and chronic disease management, a security failure can ripple beyond one office and into daily life through missed bills, insurance confusion and fear over identity theft.