Horizon Healthcare RCM
Disclosed Jun 27, 20251 year ago210,901 affectedConfirmed
Horizon Healthcare RCM, the business associate (BA), reported that it experienced a hacking incident that compromised the protected health information (PHI) of 210,901individuals. The PHI involved included demographic, clinical, and financial information. The BA notified covered entities and HHS. In response to the breach, the BA sanctioned workforce members and implemented improved technical and administrative safeguards to better protect its electronic PHI. OCR provided technical assistance to the BA.
What is known
| People affected | 210,901 (as reported to HHS) |
|---|---|
| Disclosed | Jun 27, 2025 |
| Happened | Dec 25, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2025-11-26 Horizon Healthcare RCM Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Horizon Healthcare RCMin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Horizon Healthcare RCM (Healthcare Clearing House, IN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jun 27, 2025 | 47,404 |
| HHS archivetotal | Jun 27, 2025 | 210,901 |
| Vermont AGresidents of VT | Nov 26, 2025 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 77410 to 210901 · backfill source
- 2026-09-25 · summary: empty to Horizon Healthcare RCM, the business associate (BA), reported that it experienced a hacking incident that compromised the protected health information (PHI) of 210,901individuals. The PHI involved included demographic, clinical, and financi · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 77410 · backfill source
- 2026-09-25 · disclosed: 2025-11-26 to 2025-06-27 · backfill source
- 2026-09-25 · occurred: empty to 2024-12-25 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.