Northwest Rheumatology
Disclosed Jul 31, 20179 years ago7,468 affectedConfirmed
On April 10, 2017, the covered entity (CE), Northwest Rheumatology, experienced a ransomware incident which left a limited portion of its computer system encrypted and inaccessible. Upon investigation the CE determined that 7,468 individuals’ electronic protected health information (ePHI) may have been affected, including clinical and demographic information. The CE provided breach notification to HHS, the affected individuals, and the media. In response to OCR’s investigation, the CE strengthened password requirements, implemented new technical safeguards, revised business associate contracts, and retrained workforce members.
What is known
| People affected | 7,468 (as reported by the organization) |
|---|---|
| Disclosed | Jul 31, 2017 |
| Happened | Mar 30, 2017 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2017 data breach report: Northwest Rheumatologyin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Northwest Rheumatologymaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Northwest Rheumatology (Healthcare Provider, AZ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jul 31, 2017 | 17 |
| Maine AGresidents of ME | Jul 31, 2017 | 2 |
| HHS archivetotal | Jul 31, 2017 | 7,468 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · summary: empty to On April 10, 2017, the covered entity (CE), Northwest Rheumatology, experienced a ransomware incident which left a limited portion of its computer system encrypted and inaccessible. Upon investigation the CE determined that 7,468 individual · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.