Patients should contact:
    • RevSpring Call Center: 844-971-8621 Monday–Friday, 9:00 a.m. to 6:30 p.m. ET, excluding major U.S. holidays.
    • Website: www.rscorpnotice.com

 

As patients ourselves, we understand that news of any security incident can be concerning. Please know that this security incident did not involve CCP’s environment or patients’ electronic medical record.

What happened?

On August 17, 2026, RevSpring, a company that provides the online bill pay platform to the vendor contracted by CCP and other healthcare clients, discovered that an unauthorized person had accessed a RevSpring support tool between mid-May and June 2026, and may have obtained certain information about patients.

What information was included?
  • Information accessed varies by individual but DOES NOT INCLUDE information like medical diagnoses, treatment, credit/debit card, or banking information but MAY INCLUDE information like name, address, email, phone, date of birth, Social Security number.
  • We take security and privacy of our patients’ information very seriously. As CCP patients ourselves in many cases, the best thing to do is follow the instructions on the letter if you receive one.
  • RevSpring determined data was accessed between mid-May and June 2026, but the data accessed was not limited to those who paid their bill online during that period. It could include patients seen at any point at CCP and whether or not they paid their bill online.
Am I impacted?

RevSpring is notifying affected patients directly by postal mail starting November 4, 2026 (it may take a few weeks to receive your letter). The letter will explain what happened, what information of the patient’s was involved, and what steps they can take.

What do I do if I receive a letter?

We recommend you carefully review the letter, follow the instructions provided, and take advantage of the complimentary credit monitoring and identity protection services being offered. RevSpring also recommends affected individuals review statements from healthcare providers and financial institutions and their credit reports and report any suspicious activity as soon as possible.

Was my spouse’s or another family member’s information affected?

If a family member was affected, they will receive their own letter.

Why did the patient letters come from RevSpring?

This was RevSpring’s security incident and did not involve CCP’s environment. RevSpring has the specific information about who was affected and what information was involved, which is why they are notifying affected individuals directly and handling questions specific to the incident. RevSpring is also providing the credit monitoring and identity protection resources and has the details needed to assist patients with those services. CCP is assisting as appropriate and helping our patients understand the incident and where to go for additional information or assistance.

I didn’t receive a letter, but can CCP tell if I was impacted?

CCP cannot determine or look up whether an individual was affected. We can’t speculate. Patients should call RevSpring’s dedicated call center set up to assist patients at 844-971-8621

Is it safe to pay CCP bills online and will we continue using this system?

The RevSpring payment system is operational, and patients can continue to pay their bills online (either when prompted by text to do so or by visiting communitycare.com). The incident was contained and the tool is not considered a risk.

What’s being done to avoid this in the future?

We take the protection of patient information very seriously, both within our own systems and in our work with our vendors. RevSpring reported that they contained the incident, replaced the affected credentials and added safeguards to help prevent a similar incident. The identity monitoring services are an additional way to protect your identity.

Why wasn’t I notified sooner?

Identifying exactly who was affected required a careful review of a large amount of data. RevSpring worked with our practice to notify affected individuals as quickly as possible.

Has law enforcement been notified? Has the person be caught?

RevSpring notified law enforcement. We don’t have details about any law enforcement investigation.

All patient questions should be directed to:

  • RevSpring Call Center: 844-971-8621 Monday–Friday, 9:00 a.m. to 6:30 p.m. ET, excluding major U.S. holidays.
  • Website: www.rscorpnotice.com