Northwestern Medical Center
Disclosed Aug 9, 20224 years ago686 affectedConfirmed
The covered entity (CE), Northwest Medical Center, reported that an employee impermissibly accessed medical records containing the protected health information (PHI) of 686 individuals. The PHI involved included names, addresses, drivers’ license and Social Security numbers, dates of birth, and diagnoses. The CE notified HHS, affected individuals, and the media. A call center was created for questions or concerns. Following the breach, the CE sanctioned the employee responsible and strengthened its administrative and security safeguards to better protect its PHI. All staff were retrained.
What is known
| People affected | 686 (as reported to HHS) |
|---|---|
| Disclosed | Aug 9, 2022 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2022-08-15 Northwestern Medical Center Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Northwestern Medical Center (Healthcare Provider, VT)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Aug 9, 2022 | 686 |
| Vermont AGresidents of VT | Aug 15, 2022 |
History of this record
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 686 · backfill source
- 2026-09-25 · disclosed: 2022-08-15 to 2022-08-09 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Northwest Medical Center, reported that an employee impermissibly accessed medical records containing the protected health information (PHI) of 686 individuals. The PHI involved included names, addresses, drivers’ l · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.