Avem Health Partners avemhealthpartners.com

Avem Health Partners data breach: what happened and what to do

Avem Health Partners reported to HHS that a cyberattack at a vendor of its business associate exposed the health information of 271,303 people. Names, addresses, dates of birth, Social Security numbers, financial details and treatment information were involved.

View all 13,177 breaches

Breach date: 14 May 2022
Made public: 13 Dec 2022
Affected: 271,303
Data exposed: Names, Physical addresses, Dates of birth, Social security numbers, Financial information, Diagnoses, Treatment information
Last updated: 1 Nov 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Avem Health Partners, an Oklahoma City company that provides administrative and technology services to rural hospitals, told HHS that 271,303 people were affected by a cybersecurity attack. The breach did not happen on Avem's own systems. It happened at a vendor used by one of Avem's service providers.

What happened

According to Avem's notice as reported by health-sector press, the attack hit 365 Data Centers, a data storage vendor used by a third-party service provider that Avem hired. Reports say unauthorized access took place in May 2022 and that Avem was told in the autumn of that year. Avem reported the breach to HHS in December 2022.

Sources checked: ocrportal.hhs.gov, techtarget.com, iapp.org

Last verified against the official page: 1 Nov 2026

How we research this Report an error

What was exposed

HHS's description lists names, addresses, dates of birth, Social Security numbers, financial information, diagnoses and other treatment information. The mix of identity and health details means the exposure supports both financial identity theft and targeted scams that mention your care.

The company's response

Avem notified HHS, the affected people and the media. The company later agreed to a $1.45 million class action settlement without admitting wrongdoing, according to news reports. If you were sent a notice, the settlement terms and claim deadlines are in the notice or on the settlement administrator's site.

What it means for you

A long chain of vendors held this data, and most patients had never heard of Avem. If you got a letter, it explains how your record was involved. If you didn't, you may still want to protect your credit as a precaution if you were treated at a rural Oklahoma hospital in that period.

What to do if you were in it

1

Freeze your credit at all three bureaus

A freeze stops new credit being opened in your name and costs nothing. Place it with Equifax, Experian and TransUnion; the FTC explains how at consumer.ftc.gov. Lift it temporarily when you apply for credit yourself.
2

Read the notice letter and use the protection it offers

If a letter arrived, it lists what was exposed and often includes free credit monitoring or identity restoration with an enrollment deadline. Sign up before that date passes.
3

Watch your statements and credit reports

Check bank and card statements for charges you don't recognize, and pull your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov and follow the recovery plan it gives you.
4

Expect phishing that mentions the breach

Scammers use news of a breach to sound legitimate. Don't click links or call numbers in unexpected texts or emails about it. Contact the company through the phone number or site on your own card or statement.
5

Check whether your email or phone is in this and other breaches

Serus monitors breach databases and the dark web and alerts you when your details appear, with steps for each case. A free scan shows where you stand today.

Official filings

U.S. Department of Health and Human Services , filed 13 Dec 2022 : 271,303 people

Timeline

14 May 2022
The breach happened
13 Dec 2022
The company made it public
13 Dec 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by this breach?

Check the notice letter you received. Organizations usually mail one to each person whose data was involved. If you have no letter and think your data was held, contact Avem Health Partners using the details on its own website.

Should I freeze my credit?

If your Social Security number or similar ID details were exposed, the FTC says a credit freeze is a free way to block new accounts being opened in your name. Place it with Equifax, Experian and TransUnion.

What should I do if I get a message about the breach?

Treat it with care. Criminals send fake breach alerts. Go to the company's own site or the number on your statements instead of using a link or number in the message.