Utah Imaging Associates
Disclosed Nov 3, 20214 years ago582,170 affectedConfirmed
The covered entity (CE), Utah Imaging Associates, reported that it experienced a ransomware incident that affected the protected health information (PHI) of 582,170 individuals. The PHI involved included names, addresses, birthdates, Social Security numbers, diagnoses, lab results, and medications. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the CE offered free credit monitoring to affected individuals and implemented additional administrative, technical, and security safeguards. During the investigation, OCR provide the CE with technical assistance regarding the HIPAA Security and Breach Notification Rules.
What is known
| People affected | 582,170 (as reported by the organization) |
|---|---|
| Disclosed | Nov 3, 2021 |
| Discovered | Sep 4, 2021 |
| Happened | Aug 29, 2021 |
| Attack | Ransomware |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Utah Imaging Associatesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Utah Imaging Associatesatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Utah Imaging Associatesjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: Utah Imaging Associatesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Utah Imaging Associates (Healthcare Provider, UT)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Nov 3, 2021 | 582,170 |
| California AGresidents of CA | Nov 18, 2021 | |
| Washington AGresidents of WA | Nov 18, 2021 | 895 |
| Oregon DOJresidents of OR | Nov 18, 2021 | 582,170 |
| Indiana AGresidents of IN | Nov 18, 2021 | 162 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · disclosed: 2021-11-18 to 2021-11-03 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Utah Imaging Associates, reported that it experienced a ransomware incident that affected the protected health information (PHI) of 582,170 individuals. The PHI involved included names, addresses, birthdates, Social · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 582170 · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2021-09-04 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.