Northern Iowa Therapy

Disclosed Oct 27, 20235,529 affectedConfirmed

Northern Iowa Therapy, the business associate (BA), reported that it experienced a cyberattack that affected the protected health information (PHI) of 5,112 individuals. The breached PHI included names, addresses, dates of birth, social security numbers, phone numbers, email addresses, diagnoses and conditions, and health insurance and other treatment information. The BA notified HHS, the affected individuals, and the media. The BA took several corrective actions in response to the breach including implementing additional administrative and technical safeguards. OCR provided technical assistance regarding its health information privacy compliance obligations.

What is known

People affected	5,529 (as reported by the organization)
Disclosed	Oct 27, 2023
Happened	Mar 10, 2023
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticein.gov

Indiana Attorney General 2023 data breach report: Northern Iowa Therapy

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Northern Iowa Therapy (Business Associate, IA)

Notices filed

Residents of INOct 27, 2023

Indiana AG2 people

TotalOct 29, 2023

HHS archive5,112 people

History of this record

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

summary2026-09-25

empty to Northern Iowa Therapy, the business associate (BA), reported that it experienced a cyberattack that affected the protected health information (PHI) of 5,112 individuals. The breached PHI included names, addresses, dates of birth, social secby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Northern Iowa Therapy