Penn Medicine data breach: what happened and what to do

HHS lists a Penn Medicine incident that potentially affected 917 patients. An employee of a staffing agency placed at Penn was arrested for fraud and had accessed patient records. Names, dates of birth, Social Security numbers and clinical information were involved.

View all 13,177 breaches

Breach date: 21 May 2019
Made public: 21 May 2019
Affected: 917
Data exposed: Names, Dates of birth, Social security numbers, Medical information
Last updated: 25 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

An employee of a staffing agency, placed at Penn Medicine, was arrested for fraud. Penn then determined that she had impermissibly accessed and used at least one patient's protected health information, and that the records of 917 people were potentially affected. The U.S. Department of Health and Human Services (HHS) lists the case with that count.

This was not an outside hacking campaign. It was misuse of access by someone working inside the organization, which is a different risk from a stolen database.

Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov

Last verified against the official page: 25 Oct 2026

How we research this Report an error

What was exposed

HHS says the information included names, dates of birth, Social Security numbers and clinical information. Some of the patients were people whose records the worker likely opened only to do her job. Penn notified all potentially affected individuals.

A name, date of birth and Social Security number are what someone needs to apply for credit in another person's name. That is why this kind of case matters even when the number of people is small.

The company's response

Penn Medicine provided breach notification to HHS and to everyone potentially affected. Afterward it required its staffing agencies to run more thorough background checks on workers placed there. HHS reviewed Penn's response, including its business associate agreement.

What this means for you

If you got a letter from Penn Medicine, take the Social Security number seriously. Fraud involving a single insider can still lead to new accounts or loans, so the steps below are worth doing even though the group affected was small.

What to do if you were in it

1

Freeze your credit at all three bureaus

A freeze is free and stops most new accounts being opened in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it when you apply for credit yourself.
2

Read your statements and explanation of benefits

Look for charges, accounts or medical services you don't recognize, and report anything odd to the company that sent it.
3

Expect messages that mention the breach

Scammers write to affected people with real details to sound credible. Don't click links in unexpected emails or texts. Go to the company's own site or the phone number on your card.
4

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
5

Check whether your email or phone is in this and other breaches

A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.