Choice Health Insurance
Disclosed Jun 8, 20224 years ago68,170 affectedConfirmed
Choice Health Insurance, the covered entity (CE), learned that its business associate (BA) experienced a cybersecurity incident that affected the protected health information (PHI) of 32,064 individuals. The PHI involved included names, addresses, dates of birth, and Social Security numbers. The CE notified HHS, affected individuals, the media, and posted substitute breach notice on its website. In response to the breach, the CE and BA implemented additional administrative and technical safeguards and retrained its staff.
What is known
| People affected | 68,170 (as reported by the organization) |
|---|---|
| Disclosed | Jun 8, 2022 |
| Discovered | May 14, 2022 |
| Happened | May 7, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Choice Health Insuranceoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Choice Health Insuranceatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Choice Health Insurancejustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2022 data breach report: Choice Health Insurancein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Choice Health Insurance (Business Associate, SC)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jun 8, 2022 | |
| Washington AGresidents of WA | Jun 8, 2022 | 1,844 |
| Oregon DOJresidents of OR | Jun 8, 2022 | 68,170 |
| Indiana AGresidents of IN | Jun 8, 2022 | 1,084 |
| HHS archivetotal | Aug 15, 2022 | 14,307 |
| HHS archivetotal | Oct 11, 2022 | 32,064 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Choice Health Insurance, the covered entity (CE), learned that its business associate (BA) experienced a cybersecurity incident that affected the protected health information (PHI) of 32,064 individuals. The PHI involved included names, add · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 68170 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2022-05-14 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.