Baesman Group
Disclosed Aug 17, 20233 years ago1,170,094 affectedConfirmed
The business associate (BA), Baesman Group, reported that a software application exposed the protected health information (PHI) of 1,170,094 individuals. The PHI involved included names, dates of birth, and addresses. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA strengthened its administrative and technical safeguards to better protect PHI. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 1,170,094 (as reported to HHS) |
|---|---|
| Disclosed | Aug 17, 2023 |
| Discovered | May 31, 2023 |
| Happened | May 29, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Baesman Groupoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Baesman Groupatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Baesman Groupjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Baesman Group (Business Associate, OH)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Aug 17, 2023 | 1,170,094 |
| California AGresidents of CA | Feb 29, 2024 | |
| Washington AGresidents of WA | Feb 29, 2024 | 1,658 |
| Oregon DOJresidents of OR | Feb 29, 2024 | 863,812 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1170094 · backfill source
- 2026-09-25 · disclosed: 2024-02-29 to 2023-08-17 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Baesman Group, reported that a software application exposed the protected health information (PHI) of 1,170,094 individuals. The PHI involved included names, dates of birth, and addresses. The BA notified HHS, a · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2023-05-31 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.