Health Recovery Services

Disclosed Apr 5, 201920,485 affectedConfirmed

Health Recovery Services, Inc., the covered entity (CE), reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of approximately 20,485 individuals. The ePHI involved included names, addresses, birthdates, telephone numbers, Social Security numbers, diagnoses, treatment information, and health insurance information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented new technical safeguards to better protect its data. OCR provided technical assistance to the CE regarding the HIPAA Security Rule.

What is known

People affected	20,485 (as reported by the organization)
Disclosed	Apr 5, 2019
Happened	Nov 14, 2018
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticein.gov

Indiana Attorney General 2019 data breach report: Health Recovery Services

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Health Recovery Services (Healthcare Provider, OH)

Notices filed

Residents of INApr 5, 2019

Indiana AG3 people

TotalApr 5, 2019

HHS archive20,485 people

History of this record

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

summary2026-09-25

empty to Health Recovery Services, Inc., the covered entity (CE), reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of approximately 20,485 individuals. The ePHI involved included nameby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Health Recovery Services