Health Quest Systems
Disclosed May 31, 20197 years ago372,043 affectedConfirmed
The covered entity (CE), Health Quest Systems, Inc., reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 372,043 individuals. The ePHI involved included names, Social Security numbers, drivers’ license numbers, financial information, health insurance information lab results, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI. OCR obtained assurances that the CE implemented the corrective action noted.
What is known
| People affected | 372,043 (as reported to HHS) |
|---|---|
| Disclosed | May 31, 2019 |
| Discovered | Oct 25, 2019 |
| Happened | Jul 11, 2018 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Government IDs, Payment cards, Financial, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Health Quest Systemsoag.ca.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Health Quest Systemsmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Health Quest Systems (Healthcare Provider, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | May 31, 2019 | 372,043 |
| California AGresidents of CA | Jan 10, 2020 | |
| Maine AGresidents of ME | Jan 10, 2020 | 29 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: ["names","ssn","government-id","payment-card","financial"] to ["names","ssn","government-id","payment-card","financial","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 61895 to 372043 · backfill source
- 2026-09-25 · disclosed: 2020-01-10 to 2019-05-31 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Health Quest Systems, Inc., reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 372,043 individuals. The ePHI involved inc · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn","government-id","payment-card","financial"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 61895 · backfill source
- 2026-09-25 · discovered: empty to 2019-10-25 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.