Medical Practice Solutions
Disclosed Oct 18, 20214 years ago16,737 affectedConfirmed
Medical Practice Solutions, a business associate (BA), reported that employees were the victims of an email phishing scheme that affected the protected health information (PHI) of 16,737 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, claims and financial information, and diagnoses/conditions. The BA notified HHS, affected individuals, the media, and provided substitute notice. Following the breach incident, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect its PHI. OCR provided technical assistance to the BA regarding the HIPAA Security and Breach Notification Rules.
What is known
| People affected | 16,737 (as reported by the organization) |
|---|---|
| Disclosed | Oct 18, 2021 |
| Happened | Aug 17, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: Medical Practice Solutionsin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Medical Practice Solutions (Business Associate, MS)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Oct 18, 2021 | 16,737 |
| Indiana AGresidents of IN | Mar 21, 2022 | 3 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · disclosed: 2022-03-21 to 2021-10-18 · backfill source
- 2026-09-25 · summary: empty to Medical Practice Solutions, a business associate (BA), reported that employees were the victims of an email phishing scheme that affected the protected health information (PHI) of 16,737 individuals. The PHI involved included names, address · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.