Newman Regional Health data breach: what happened and what to do

Newman Regional Health, a hospital in Emporia, Kansas, reported to HHS in April 2022 that employee email accounts were accessed, affecting 52,224 people. Names, addresses, dates of birth, Social Security numbers, financial and health insurance details, diagnoses and treatment information were involved.

View all 13,177 breaches

Breach date: 26 Jan 2021
Affected: 52,224
Data exposed: Names, Physical addresses, Dates of birth, Social security numbers, Financial information, Health insurance information, Diagnoses, Treatment information
Last updated: 29 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Newman Regional Health, a 25-bed hospital in Emporia, Kansas, told the U.S. Department of Health and Human Services on April 14, 2022 that employee email accounts had been compromised, affecting the health information of 52,224 people. HHS describes the cause as an email phishing attack on multiple employees. Press coverage of the hospital's notice says the accounts were accessed between January 26 and November 23, 2021, and that the investigation finished on March 14, 2022.

Sources checked: ocrportal.hhs.gov, hipaajournal.com, infosecurity-magazine.com

Last verified against the official page: 29 Oct 2026

How we research this Report an error

What was exposed

According to HHS, the data involved names, addresses, dates of birth, Social Security numbers, financial and health insurance information, diagnoses, medications and other treatment information. Not everyone had every item exposed.

A Social Security number together with a date of birth is what criminals need to try to open credit in someone's name. Treatment details and insurance numbers can be used for medical identity fraud or to make phishing messages sound real.

The hospital's response

Newman Regional Health notified HHS, the people affected and the media, and posted a substitute notice. It offered free credit monitoring, added administrative, technical and security safeguards, and retrained staff on email security. The hospital also set up an assistance line for people with questions. It reported no evidence of fraud as a result.

What to do if you were in it

1

Read the notice letter

If you were affected you should get a letter from the organization. It says which of your details were involved and whether it offers free credit monitoring. The FTC recommends taking that offer.
2

Freeze your credit

Because Social Security numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. Check your reports at annualcreditreport.com.
3

Read your health insurance statements

Look at explanation of benefits statements for treatment or claims you don't recognize, and tell your insurer if something is wrong.
4

Treat messages about the breach as suspect

Expect calls, texts and emails that use real details. Don't click links or give details to someone who contacts you first; contact the organization using a number from its own website.
5

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.

Official filings

U.S. Department of Health and Human Services , filed 14 Apr 2022 : 52,224 people

Timeline

26 Jan 2021
The breach happened
14 Apr 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Newman Regional Health data breach?

The organization sent letters to the people whose details were involved. If you were a patient and got no letter, contact it directly using the contact details on its own website.

What was exposed?

Names, addresses, dates of birth, Social Security numbers, financial and health insurance information, diagnoses, medications and other treatment information, according to HHS.

Should I freeze my credit?

If your Social Security number was exposed, a freeze is a sensible step. It's free, you set it up at each of the three bureaus, and you can lift it when you need to apply for credit.