Family Health Services
Disclosed May 23, 20251 year ago4,040 affectedConfirmed
Family Health Services, the business associate (BA) reported that it experienced a cyberattack that compromised the protected health information (PHI) of 4,025 individuals. The PHI involved included demographic, clinical, and financial information. The BA notified HHS, impacted individuals, and the media. In its mitigation efforts, the BA implemented additional administrative, technical, and security safeguards to better protect sensitive data. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 4,040 (as reported by the organization) |
|---|---|
| Disclosed | May 23, 2025 |
| Happened | Jan 27, 2025 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2025 data breach report: Family Health Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Family Health Services (Business Associate, NE)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | May 23, 2025 | 3 |
| HHS archivetotal | May 23, 2025 | 4,025 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Family Health Services, the business associate (BA) reported that it experienced a cyberattack that compromised the protected health information (PHI) of 4,025 individuals. The PHI involved included demographic, clinical, and financial info · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.