RevSpring

Disclosed Dec 22, 20231,053 affectedConfirmed

The business associate (BA), RevSpring, reported that a software coding error allowed the protected health information (PHI) of 1,053 individuals to be viewable by others. The PHI involved included names, addresses, diagnoses and other treatment information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA implemented additional administrative, technical, and security safeguards. Workforce members were also retrained on the requirements to protect and secure sensitive data.

What is known

People affected	1,053 (as reported to HHS)
Disclosed	Dec 22, 2023
Attack	Insider
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): RevSpring (Business Associate, TN)

Notices filed

TotalDec 22, 2023

HHS archive1,053 people

Other breaches at RevSpring

Breach, details not statedExposed names, Social Security numbers, dates of birth and addresses. Reported to the California AG.2.0M affectedHealthcareUSNov 4 Breach, details not statedExposed names and health records. Reported to the HHS archive.3,000 affectedHealthcareUSJan 6, 2014

History of this record

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.

Everything about RevSpring