HealthReach Community Health Centers
Disclosed Jul 6, 20215 years ago122,308 affectedConfirmed
The covered entity (CE), HealthReach Community Health Centers, reported that its business associate (BA) improperly disposed of hard drives that contained the protected health information (PHI) of 122,308 individuals. The PHI involved included names, addresses, date of birth, drivers’ license and Social Security numbers, diagnoses, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE offered free credit monitoring services and the BA retrained its staff on the proper methods of disposing of sensitive data and equipment.
What is known
| People affected | 122,308 (as reported to HHS) |
|---|---|
| Disclosed | Jul 6, 2021 |
| Happened | Apr 7, 2021 |
| Attack | Lost or stolen device |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2021 data breach report: HealthReach Community Health Centersin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): HealthReach Community Health Centers (Healthcare Provider, ME)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jul 6, 2021 | 122,308 |
| Indiana AGresidents of IN | Sep 9, 2021 | 63 |
History of this record
- 2026-09-25 · attack: unknown to lost-device · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 115082 to 122308 · backfill source
- 2026-09-25 · disclosed: 2021-09-09 to 2021-07-06 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), HealthReach Community Health Centers, reported that its business associate (BA) improperly disposed of hard drives that contained the protected health information (PHI) of 122,308 individuals. The PHI involved inclu · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.