Avamere Health Services
Disclosed Jun 27, 20224 years ago229,460 affectedConfirmed
The business associate (BA), Avamere Health Services, reported that its network provider experienced a ransomware attack that affected the protected health information (PHI) of 229,460 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, claims and financial information, diagnoses, lab results, and medication data. The BA notified HHS, affected individuals, and the media. Upon discovering the breach, the BA provided complimentary credit monitoring services and strengthened its technical safeguards. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 229,460 (as reported to HHS) |
|---|---|
| Disclosed | Jun 27, 2022 |
| Discovered | Mar 17, 2022 |
| Happened | Jan 19, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: Avamere Health Servicesatg.wa.gov · Official notice | Official notice |
| Vermont Attorney General: 2022 11 24 Avamere Health Services Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Avamere Health Services (Business Associate, OR)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | Jun 27, 2022 | 65,076 |
| HHS archivetotal | Jul 13, 2022 | 229,460 |
| Vermont AGresidents of VT | Nov 24, 2022 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 229460 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Avamere Health Services, reported that its network provider experienced a ransomware attack that affected the protected health information (PHI) of 229,460 individuals. The PHI involved included names, addresses · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2022-11-24-avamere-health-services-data-breach-notice-consumers · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.