Legacy Health

Disclosed Nov 23, 20228,065 affectedConfirmed

Legacy Health, the covered entity (CE), reported that a workforce member impermissibly downloaded the protected health information (PHI) of 8,065 individuals to personal storage devices. The PHI involved included names, dates of birth, Social Security numbers, health insurance information, lab results, diagnoses, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE implemented additional technical safeguards to better protect its PHI. OCR provided technical assistance regarding the HIPAA Rules.

What is known

People affected	8,065 (as reported to HHS)
Disclosed	Nov 23, 2022
Discovered	Jul 25, 2022
Happened	Jul 25, 2022
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeatg.wa.gov

Washington Attorney General breach notice: Legacy Health

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Legacy Health (Healthcare Provider, OR)

Notices filed

Residents of WANov 23, 2022

Washington AG1,608 people

TotalNov 23, 2022

HHS archive8,065 people

Other breaches at Legacy Health

Insider breachInsider exposed names, health records and insurance details. Reported to the HHS OCR.6,547 affectedHealthcareUSOct 23, 2025 Hacking breachHacking exposed names and health records. Reported to the HHS archive.38K affectedHealthcareUSAug 20, 2018

History of this record

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 8065by backfillSource

summary2026-09-25

empty to Legacy Health, the covered entity (CE), reported that a workforce member impermissibly downloaded the protected health information (PHI) of 8,065 individuals to personal storage devices. The PHI involved included names, dates of birth, Sociby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.

Everything about Legacy Health