athenahealth
Disclosed Nov 15, 20241 year ago1,974 affectedConfirmed
Athenahealth, the covered entity (CE), reported that an employee posted the protected health information (PHI) of 1,974 individuals to the Internet. The PHI involved included names, addresses, dates of birth, Social Security numbers, and health insurance and claims information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its sensitive data. The staff involved in this disclosure were retrained.
What is known
| People affected | 1,974 (as reported by the organization) |
|---|---|
| Disclosed | Nov 15, 2024 |
| Happened | Apr 3, 2024 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2024 data breach report: athenahealthin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): athenahealth (Business Associate, MA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Nov 15, 2024 | 4 |
| HHS archivetotal | Nov 15, 2024 | 1,974 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Athenahealth, the covered entity (CE), reported that an employee posted the protected health information (PHI) of 1,974 individuals to the Internet. The PHI involved included names, addresses, dates of birth, Social Security numbers, and he · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.