Vail Health Services
Disclosed Jan 14, 20224 years ago41,889 affectedConfirmed
The covered entity (CE), Vail Health Services, reported that multiple employees were victims of an email phishing attack affecting the protected health information (PHI) of 41,889 individuals. The PHI involved included names, dates of birth, addresses, diagnoses, passport numbers, health insurance information, drivers’ license numbers, Social Security numbers, and clinical information. The CE notified HHS, affected individuals, the media, and provided substitute notification. In response to the breach, the CE retrained its staff on email security and implemented additional technical safeguards. OCR provided technical assistance to the CE regarding its HIPAA Privacy Rule and Security Rule obligations.
What is known
| People affected | 41,889 (as reported to HHS) |
|---|---|
| Disclosed | Jan 14, 2022 |
| Happened | Dec 11, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: Vail Health Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Vail Health Services (Healthcare Provider, CO)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jan 14, 2022 | 11 |
| HHS archivetotal | May 4, 2022 | 41,889 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 4028 to 41889 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Vail Health Services, reported that multiple employees were victims of an email phishing attack affecting the protected health information (PHI) of 41,889 individuals. The PHI involved included names, dates of birth · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.