Howard Memorial Hospital howardmemorial.com Howard Memorial Hospital data breach: what happened and what to do
Howard Memorial Hospital in Nashville, Arkansas, reported a cyberattack in which files were taken between November 14 and December 4, 2022. HHS lists 53,668 people affected. Exposed data included names, dates of birth, addresses, Social Security numbers and treatment information.
View all 13,177 breaches- Breach date
- 14 Nov 2022
- Affected
- 53,668
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Medical information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Howard Memorial Hospital, in Nashville, Arkansas, detected suspicious activity on its computer network on December 4, 2022. Its investigation found that files may have been taken by an unknown actor between November 14 and December 4. The hospital posted a public notice dated December 29, 2022 and contacted federal law enforcement.
The hospital reported the incident to HHS as a hacking incident affecting 53,668 people. A filing with the Maine Attorney General lists a slightly different count (54,430), so the number depends on the source. This page uses the HHS figure.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS's description says the information involved included names, dates of birth, addresses, Social Security numbers, diagnoses, lab results, medications and other treatment information. Individual letters dated January 2023 also mention medical record numbers and physician names. Not every item applied to every person, and the hospital said patient and employee data was involved.
A Social Security number with a date of birth lets a criminal apply for credit in your name. Treatment details can be used to write convincing phone calls and texts that claim to be from a clinic, pharmacy or insurer.
The hospital's response
The hospital notified HHS, the people affected and the media, and strengthened its administrative and technical safeguards. The individual letter includes a section on enrolling in credit monitoring. Check your own letter for the terms, since enrollment periods for 2023 notices have probably ended.
What to do if you were in it
- 1
Read your notice and the monitoring offer
Your letter says which details were involved. If it includes credit monitoring, the FTC recommends taking it. Enrollment windows have likely closed, so call the hospital if you have questions.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and blocks most new accounts opened in your name. Place it separately at Equifax, Experian and TransUnion, and lift it when you need to apply for credit.
- 3
Check medical bills and insurance statements
Look for services you never received and report anything odd to your insurer.
- 4
Treat unexpected calls and texts about your care with suspicion
Contact the clinic, pharmacy or insurer on a number you already have rather than one in a message.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan for your email address and phone number against breach databases and the dark web, and alerts you when something new shows up. Breach data can't be taken back from the places it spread to, so the scan tells you what to act on.
Official filings
- U.S. Department of Health and Human Services , filed 27 Jan 2023 : 53,668 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Howard Memorial Hospital breach?
People whose data was involved should have received a letter in early 2023. If you were a patient or employee around 2022 and never got one, ask the hospital.
What was exposed in the Howard Memorial Hospital breach?
HHS's description lists names, dates of birth, addresses, Social Security numbers, diagnoses, lab results, medications and other treatment information.
How many people were affected?
HHS lists 53,668 people. A Maine Attorney General filing counts 54,430, so reported totals differ slightly.
Should I freeze my credit?
If your Social Security number was involved, the FTC says a freeze is a free way to block new accounts opened in your name.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- identitytheft.gov/databreach
- arkansasonline.com/news/2022/dec/29/howard-memorial-hospital-in-southwest-arkansas-says-patient-and-employee-data-stolen-in-cybersecurity-attack/
- maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/bb145848-5601-42ec-97d7-a0ebb4ed227a.shtml
Something wrong or out of date? Tell us and we'll re-check it.
