Munson Healthcare Data Breach Report

Incident Overview

Munson Healthcare, a healthcare provider organization based in Michigan, experienced an unauthorized access and disclosure incident involving paper medical records and films on an unspecified date prior to the September 17, 2025 submission date. The breach resulted in the exposure of protected health information (PHI) belonging to 1,186 individuals. This incident represents a breach of physical security controls over sensitive patient documentation, a category of breach that continues to affect healthcare organizations despite increased focus on cybersecurity threats.

Discovery and Response Timeline

The specific date of discovery and the timeline of Munson Healthcare's response have not been detailed in the available breach submission data. However, under HIPAA Breach Notification Rule requirements, the organization was obligated to conduct a thorough investigation to determine the scope of the breach, identify affected individuals, and initiate notification procedures without unreasonable delay. The September 17, 2025 submission date to the Department of Health and Human Services indicates that the organization completed its investigation and determined the breach met the threshold for notification (affecting more than 500 residents of a single state, triggering media notification requirements). The organization likely implemented immediate containment measures upon discovery, including securing the affected physical location, restricting access to compromised records, and preserving evidence for investigation purposes.

Breach Mechanics and Physical Security Context

This breach involved unauthorized access to paper medical records and films—physical documents rather than digital systems. This classification suggests several possible scenarios: misplaced or lost records that were subsequently accessed by unauthorized parties, theft of physical files from a healthcare facility, unauthorized access by individuals with facility access but without authorization to view specific patient records, or inadequate physical security controls such as unlocked storage areas, unsecured file rooms, or insufficient monitoring of record access. Paper-based breaches typically occur through loss, theft, or improper disposal of physical documents. The involvement of "films" suggests radiological imaging materials (X-rays, CT scans, MRI films) were also compromised, indicating the breach may have affected a medical records storage area or imaging department. Unlike digital breaches that may involve sophisticated hacking techniques, physical record breaches often result from human error, inadequate facility security protocols, or insider threats. The fact that no business associate was involved indicates this was an internal Munson Healthcare incident rather than a breach occurring at a third-party vendor or service provider.

Organizational Context

Munson Healthcare operates as a healthcare system in Michigan, serving patients across the northern Michigan region. The organization provides comprehensive healthcare services including hospital care, outpatient services, and specialty care. The involvement of paper records and films in this breach suggests the organization maintains traditional physical medical record systems alongside any electronic health record (EHR) infrastructure. Many healthcare organizations, particularly those with longer operational histories or serving rural areas, maintain hybrid record systems combining paper and digital documentation. The scale of the breach (1,186 affected individuals) suggests this incident affected a significant portion of the organization's patient population or involved a centralized records storage facility serving multiple locations. The breach's classification as involving paper records rather than electronic systems may indicate either that Munson Healthcare's digital security controls are more strong, or that this particular incident occurred in a physical records area that was not adequately protected.

Patient Population Impact and Notification

Approximately 1,186 patients had their protected health information potentially accessed without authorization. These individuals were notified of the breach in accordance with HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. Because the breach affected more than 500 Michigan residents, Munson Healthcare was required to notify prominent media outlets in the state in addition to individual patient notifications. The specific types of PHI exposed likely include names, medical record numbers, dates of birth, medical histories documented in the records, diagnoses, treatment information, and potentially other sensitive identifiers contained within the physical files and radiological films. Patients whose records were compromised may have had access to their complete medical histories, which could include information about mental health treatment, substance abuse treatment, HIV status, or other highly sensitive health conditions depending on what was documented in their records.

HIPAA Compliance and Industry Context

This breach highlights an ongoing vulnerability in healthcare security: the protection of physical records and media. While much regulatory attention and industry resources focus on cybersecurity and digital breach prevention, physical security remains a critical component of HIPAA compliance. The HIPAA Security Rule requires covered entities to implement physical safeguards including facility access controls, workstation use policies, workstation security, and device and media controls. The breach at Munson Healthcare suggests potential gaps in one or more of these physical safeguard categories. According to HHS breach notification data, unauthorized access incidents—whether physical or digital—represent a significant portion of healthcare breaches. Physical record breaches often stem from inadequate access controls, insufficient employee training on record handling procedures, or lack of monitoring systems to detect unauthorized access. This incident serves as a reminder that healthcare organizations must maintain vigilant oversight of both digital and physical information assets, implementing controls such as locked storage facilities, access logs for sensitive records, regular audits of record locations, and employee training on proper handling of patient information.