University Gastroenterology
Disclosed Aug 16, 201610 years ago15,478 affectedConfirmed
An unauthorized person gained access to the covered entity’s (CE) electronic file storage system. The breach affected 15,478 individuals’ protected health information (PHI) and included patients’ names, addresses, dates of birth, social security numbers, and medical billing information. Following the breach, the CE completely dismantled the accessed system. OCR reviewed the CE’s policies and procedures for safeguarding PHI, which conform to the HIPAA Privacy and Security Rules. The CE provided OCR with assurances that it provided breach notification to affected individuals and the media.
What is known
| People affected | 15,478 (as reported to HHS) |
|---|---|
| Disclosed | Aug 16, 2016 |
| Happened | Jan 15, 2016 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Health, Addresses |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2016 data breach report: University Gastroenterologyin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: University Gastroenterologymaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): University Gastroenterology (Healthcare Provider, RI)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Aug 16, 2016 | 1 |
| Maine AGresidents of ME | Sep 8, 2016 | 17 |
| HHS archivetotal | Sep 8, 2016 | 15,478 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 15478 · backfill source
- 2026-09-25 · summary: empty to An unauthorized person gained access to the covered entity’s (CE) electronic file storage system. The breach affected 15,478 individuals’ protected health information (PHI) and included patients’ names, addresses, dates of birth, social sec · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn","health","addresses"] · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.