UW Medicine

Disclosed Jun 4, 202118,389 affectedConfirmed

UW Medicine, the covered entity (CE), reported that its business associate (BA) experienced a cyber-attack that compromised the protected health information (PHI) of 3,804 individuals. The PHI involved included names, addresses, claims and financial information, medical record numbers, and treatment information. The CE and BA notified HHS, affected individuals, and the media. In its mitigation efforts, the CE provided complimentary credit monitoring services and implemented additional administrative and technical safeguards. OCR provided technical assistance regarding the HIPAA Rules.

What is known

People affected	18,389 (as reported to HHS)
Disclosed	Jun 4, 2021
Discovered	Apr 18, 2022
Happened	Apr 16, 2022
Attack	Lost or stolen device
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeatg.wa.gov

Washington Attorney General breach notice: UW Medicine

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): UW Medicine (Healthcare Provider, WA)

Notices filed

TotalJun 4, 2021

HHS archive18,389 people

Residents of WAJun 15, 2022

Washington AG739 people

TotalJun 15, 2022

HHS archive763 people

TotalSep 21, 2022

HHS archive3,804 people

Other breaches at UW Medicine

Hacking breachHacking exposed names and health records. Reported to the HHS archive.973K affectedHealthcareUSFeb 20, 2019

History of this record

records2026-09-25

3804 to 18389by backfillSource

disclosed2026-09-25

2022-06-15 to 2021-06-04by backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 3804by backfillSource

summary2026-09-25

empty to UW Medicine, the covered entity (CE), reported that its business associate (BA) experienced a cyber-attack that compromised the protected health information (PHI) of 3,804 individuals. The PHI involved included names, addresses, claims and by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.

Everything about UW Medicine