Health Aid of Ohio healthaidofohio.com Health Aid of Ohio data breach: what happened and what to do
Health Aid of Ohio, a home medical equipment provider in Parma, Ohio, detected unauthorized access on February 19, 2021. HHS lists 141,149 people affected. Exposed data includes names, Social Security numbers, dates of birth, health insurance details and diagnoses.
View all 13,177 breaches- Breach date
- 19 Feb 2021
- Affected
- 141,149
- Data exposed
- Names, Physical addresses, Dates of birth, Phone numbers, Email addresses, Social security numbers, Health insurance information, Medical information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Health Aid of Ohio, a home medical equipment provider based in Parma, Ohio, detected unauthorized access to its systems on February 19, 2021. Investigators confirmed that files were accessed and taken, but could not say exactly which ones. The company reported the incident to the U.S. Department of Health and Human Services (HHS), which lists 141,149 people affected. HHS describes it as a ransomware intrusion.
What was exposed
Per HHS, the information involved included names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, claims information, health insurance information, diagnoses and medical conditions, lab results, medications and other treatment information.
That mix matters. A Social Security number plus a date of birth is what criminals need to try opening credit in someone's name. Medical details and insurance information can be used for medical identity theft or to make a phishing message sound legitimate, for example a fake call about an equipment delivery or an insurance claim.
The company's response
Health Aid of Ohio notified HHS, the affected individuals and the media, and offered complimentary credit monitoring. It also added administrative and technical safeguards. A class action over the breach was settled without the company admitting wrongdoing.
Sources checked: consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Your Social Security number was involved, so a credit freeze is the strongest step. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. A freeze stops lenders from seeing your report, which blocks most new accounts opened in your name.
- 2
Take the free credit monitoring if you were offered it
The notice letter explains how to enroll. The FTC recommends using free monitoring when a company offers it after a breach.
- 3
Check your health insurance statements
Read your explanation of benefits (EOB) for services you didn't receive. If you see any, tell your insurer and report it at IdentityTheft.gov.
- 4
Expect scams that mention the breach
Contact details tied to a real company make phishing emails, texts and calls more convincing. Don't click links or give out information on an unexpected message. Contact the company using a number from its official website instead.
Official filings
- U.S. Department of Health and Human Services , filed 20 Apr 2021 : 141,149 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Health Aid of Ohio breach?
Only people who received a notice letter were told they were involved. HHS lists 141,149 people. If you were a customer around 2021 and never got a letter, contact the company to ask.
What was exposed?
HHS lists names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, claims and health insurance information, diagnoses, lab results and medications.
Is there a settlement?
HIPAA Journal reports that a class action in Cuyahoga County, Ohio was settled without an admission of wrongdoing. People whose Social Security number was exposed can claim a cash payment of up to $250, with more possible for documented fraud losses. Check the settlement administrator's notice for current terms.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
