FastHealth

Disclosed May 26, 201718,192 affectedConfirmed

FastHealth Corporation, a business associate (BA), reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 18,192 individuals. The ePHI involved included names, addresses, dates of birth, drivers’ license information, Social Security numbers, financial information, diagnoses, and medications prescribed. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI. The BA notified HHS, affected individuals, and the media. OCR provided the BA with technical assistance regarding the HIPAA Breach Notification Rule.

What is known

People affected	18,192 (as reported to HHS)
Disclosed	May 26, 2017
Discovered	Nov 2, 2017
Happened	Aug 14, 2017
Attack	Hacking
Data exposed	NamesSocial Security numbersGovernment IDsPayment cardsFinancialPasswordsHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: FastHealth

Official noticeatg.wa.gov

Washington Attorney General breach notice: FastHealth

Official noticejustice.oregon.gov

Oregon DOJ breach notice: FastHealth

Official noticemaine.gov

Maine Attorney General breach notice archive: FastHealth

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): FastHealth (Business Associate, AL)

Notices filed

Residents of CAMay 26, 2017

California AGCount not stated

Residents of MEMay 26, 2017

Maine AG14 people

TotalJun 29, 2017

HHS archive18,192 people

Residents of CAFeb 27, 2018

California AGCount not stated

Residents of WAFeb 27, 2018

Washington AG2,876 people

Residents of ORFeb 27, 2018

Oregon DOJ657,529 people

Residents of MEFeb 27, 2018

Maine AG881 people

TotalFeb 27, 2018

HHS archive18,192 people

History of this record

data_types2026-09-25

["names","ssn","government-id","payment-card","financial","passwords"] to ["names","ssn","government-id","payment-card","financial","passwords","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 18192by backfillSource

summary2026-09-25

empty to FastHealth Corporation, a business associate (BA), reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 18,192 individuals. The ePHI involved included names, addresses, dates by backfillSource

data_types2026-09-25

[] to ["names","ssn","government-id","payment-card","financial","passwords"]by backfillSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2017-11-02by backfillSource

disclosed2026-09-25

2018-02-27 to 2017-05-26by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about FastHealth