Baptist Medical Center
Disclosed Jun 15, 20224 years ago1,608,549 affectedConfirmed
Baptist Medical Center, the covered entity (CE), reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 1,608,549 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, claims information, diagnoses, and other treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional administrative and technical safeguards to better protect its sensitive data.
What is known
| People affected | 1,608,549 (as reported to HHS) |
|---|---|
| Disclosed | Jun 15, 2022 |
| Discovered | Apr 20, 2022 |
| Happened | Mar 31, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Baptist Medical Centeroag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Baptist Medical Centeratg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Baptist Medical Centerjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Baptist Medical Center (Healthcare Provider, TX)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jun 15, 2022 | |
| Washington AGresidents of WA | Jun 15, 2022 | 920 |
| Oregon DOJresidents of OR | Jun 15, 2022 | 1,243,031 |
| HHS archivetotal | Jun 15, 2022 | 1,608,549 |
| California AGresidents of CA | Jun 24, 2022 | |
| Oregon DOJresidents of OR | Jun 24, 2022 | 1,416,691 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1608549 · backfill source
- 2026-09-25 · summary: empty to Baptist Medical Center, the covered entity (CE), reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 1,608,549 individuals. The PHI involved included names, addresses, dates of birth, · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2022-04-20 · backfill source
- 2026-09-25 · disclosed: 2022-06-24 to 2022-06-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.