Jackson Lewis
Disclosed Jan 20, 20233 years ago20,647 affectedConfirmed
The business associate (BA), Jackson Lewis, reported that it experienced a theft of two hard drives that affected the protected health information of 986 individuals. The PHI involved included names, dates of birth, social security numbers, financial and claims information, health insurance information, diagnoses, and other treatment information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided free credit monitoring and implemented additional physical, administrative, and technical safeguards to better protect its PHI. OCR provided technical assistance.
What is known
| People affected | 20,647 (as reported by the organization) |
|---|---|
| Disclosed | Jan 20, 2023 |
| Happened | Jan 7, 2022 |
| Attack | Lost or stolen device |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Jackson Lewisoag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-03-16 Jackson Lewis Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: Jackson Lewisin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Jackson Lewis (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jan 20, 2023 | |
| Indiana AGresidents of IN | Jan 20, 2023 | 178 |
| California AGresidents of CA | Feb 17, 2023 | |
| HHS archivetotal | Feb 17, 2023 | 986 |
| California AGresidents of CA | Mar 16, 2023 | |
| Vermont AGresidents of VT | Mar 16, 2023 | |
| California AGresidents of CA | Aug 31, 2023 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to lost-device · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Jackson Lewis, reported that it experienced a theft of two hard drives that affected the protected health information of 986 individuals. The PHI involved included names, dates of birth, social security numbers, · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 20647 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-03-16-jackson-lewis-data-breach-notice-consumers · backfill source
- 2026-09-25 · disclosed: 2023-02-17 to 2023-01-20 · backfill source
- 2026-09-25 · disclosed: 2023-03-16 to 2023-02-17 · backfill source
- 2026-09-25 · disclosed: 2023-08-31 to 2023-03-16 · backfill source
- 2026-09-25 · occurred: empty to 2022-01-07 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.