Adventist HealthCare

# Adventist HealthCare Data Breach Report ## Incident Overview Adventist HealthCare, a healthcare provider operating in Maryland, reported a data breach affecting approximately 1,300 individuals on November 13, 2025. The breach involved the loss of paper documents and films containing protected health information (PHI). This incident represents a physical security failure rather than a cyber-based attack, highlighting the continued vulnerability of traditional paper-based medical record systems in healthcare environments. The loss occurred at an unspecified facility location within the Adventist HealthCare system, and the breach was classified as involving a business associate, suggesting that third-party vendors or contractors may have had access to or custody of the affected materials. ## Discovery and Response Timeline Adventist HealthCare discovered the loss of the paper documents and films through internal inventory or audit procedures, though the exact discovery date and mechanism were not detailed in the breach submission. Upon discovery, the organization initiated an investigation to determine the scope of the loss, identify which individuals were affected, and assess what specific health information may have been compromised. The entity subsequently notified affected individuals in accordance with HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The involvement of a business associate in this breach suggests that Adventist HealthCare coordinated with third-party entities during both the investigation and notification process, as business associates are jointly responsible for HIPAA compliance and breach notification obligations. ## Breach Mechanism and Operational Context The loss of paper documents and films represents a physical security breach rather than a technological one. Paper-based medical records and radiographic films (X-rays, CT scans, MRI images) remain common in healthcare settings despite the industry's shift toward electronic health records (EHRs). These physical materials are particularly vulnerable to loss through several mechanisms: misplacement during file transfers, loss during transport between facilities, theft from unsecured storage areas, or disposal errors. The involvement of a business associate suggests the materials may have been in transit to or from an external vendor—potentially a medical records storage company, imaging center, transcription service, or document destruction vendor. Physical security failures of this nature often occur at transition points in the document lifecycle, such as during courier delivery, temporary storage, or handoff between departments or organizations. The fact that this breach involved films (radiographic images) in addition to paper documents indicates that the lost materials likely contained comprehensive clinical information spanning multiple service lines. ## Organizational Context Adventist HealthCare is a regional healthcare system based in Maryland with multiple facilities and service lines. The organization operates hospitals, clinics, and ancillary services across the state, serving a diverse patient population. As a faith-based healthcare system affiliated with the Seventh-day Adventist Church, Adventist HealthCare operates under standard HIPAA compliance frameworks while maintaining its organizational mission. The system's size and multi-facility structure create inherent complexity in managing physical records across multiple locations, increasing the risk of loss or misplacement. The involvement of business associates in this breach reflects the reality that modern healthcare organizations frequently outsource records management, storage, transportation, and destruction services to specialized vendors. This distributed model, while operationally efficient, creates additional security touchpoints where breaches can occur. ## Patient Impact and Affected Population Approximately 1,300 individuals were affected by this breach, representing patients who had received care at Adventist HealthCare facilities and whose records were among the lost documents and films. These individuals likely received notification letters detailing the breach, the types of information potentially exposed, and recommended protective measures. The affected population may span multiple service lines and facilities within the Adventist HealthCare system, suggesting the loss was not isolated to a single department or location. Patients affected by loss of paper records and films face different risks than those affected by cyber breaches, as the information is no longer in the organization's control and may be permanently lost, destroyed, or potentially accessed by unauthorized individuals who may have found the materials. The notification timeline would have commenced from the discovery date, with Adventist HealthCare required to provide written notice to all affected individuals within 60 days. ## Protected Health Information Exposed The lost paper documents and films likely contained multiple categories of sensitive health information. Medical records typically include patient names, dates of birth, medical record numbers, addresses, phone numbers, insurance information, diagnoses, treatment histories, medication lists, laboratory results, and clinical notes. Radiographic films (X-rays, CT scans, MRI images) contain identifying information linked to specific imaging studies and clinical findings. Depending on the nature of the records lost, the materials may have included psychiatric records, substance abuse treatment information, HIV status, or other highly sensitive diagnoses. Insurance information and financial data may also have been present on billing-related documents. The combination of demographic information, clinical data, and imaging studies creates a comprehensive profile of patient health status that could be misused if accessed by unauthorized parties. ## Industry Context and Similar Incidents Physical loss of paper records and films remains a significant source of HIPAA breaches despite the healthcare industry's transition to electronic systems. According to HHS Office for Civil Rights data, loss of physical documents consistently ranks among the top breach categories affecting healthcare organizations. The HIPAA Breach Notification Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect PHI, including secure storage, controlled access, and proper disposal procedures. Physical security failures often result from inadequate training, insufficient inventory controls, or lapses in vendor management. The involvement of a business associate in this breach underscores the importance of business associate agreements (BAAs) that clearly delineate security responsibilities and breach notification obligations. Healthcare organizations are required to ensure that business associates maintain equivalent security standards and promptly report any breaches or security incidents. Similar incidents involving loss of paper records have affected numerous healthcare providers, highlighting the persistent vulnerability of non-electronic record systems and the need for comprehensive physical security protocols across the entire document lifecycle.

# Adventist HealthCare Data Breach Report ## Incident Overview Adventist HealthCare, a healthcare organization operating in Maryland, reported a data breach affecting 1,300 individuals on November 13, 2024. The breach involved the loss of physical paper records and films, representing a traditional but still significant threat to patient privacy in the healthcare industry. Unlike digital breaches that often involve sophisticated hacking techniques, this incident demonstrates how physical security lapses can expose sensitive protected health information (PHI) to unauthorized access or misuse. ## Discovery and Response Timeline The breach was discovered and reported to the Maryland Attorney General's office on November 13, 2024, indicating that Adventist HealthCare identified the missing materials and initiated their breach response protocol in accordance with HIPAA Breach Notification Rule requirements. The organization's discovery process likely involved inventory reconciliation or staff identification of missing records during routine operations. Upon discovery, Adventist HealthCare would have been required to conduct a risk assessment to determine whether the loss constituted a reportable breach under HIPAA—a determination that resulted in notification to affected individuals. The involvement of a business associate in this breach suggests that the lost materials may have been in transit, storage, or processing by a third-party vendor, which adds complexity to the investigation and responsibility chain. ## Specific Details of the Loss The breach involved the loss of paper documents and films, which are physical media commonly used in healthcare settings for patient records, imaging results, and clinical documentation. Paper records and films represent a significant portion of healthcare data storage, particularly in established healthcare systems that may maintain hybrid digital-paper record systems. The loss of these materials could have occurred during transport between facilities, during storage at off-site locations, or through misplacement within the organization's physical infrastructure. Physical media losses are particularly concerning because once lost, there is typically no audit trail to determine who may have accessed the information or how it might be used. Unlike digital breaches where forensic analysis can sometimes identify unauthorized access patterns, physical losses create uncertainty about the ultimate disposition of the materials and the scope of potential exposure. ## Organizational Context Adventist HealthCare is a significant healthcare provider in Maryland, operating multiple facilities and providing comprehensive healthcare services to the region. As a healthcare system with sufficient scale to employ business associates for record management and processing, the organization handles substantial volumes of patient information across multiple locations and operational units. The involvement of a business associate in this breach indicates that Adventist HealthCare utilizes third-party vendors for functions such as records storage, document imaging, transportation, or archival services—a common practice among healthcare systems seeking to optimize operational efficiency. This arrangement, while operationally beneficial, creates additional responsibility for ensuring that business associates maintain adequate physical security controls over patient information. ## Patient Impact and Notification Approximately 1,300 individuals were affected by this breach, representing patients whose records were among the lost materials. These patients would have received breach notification letters from Adventist HealthCare in accordance with HIPAA requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The notification would have included information about the nature of the breach, the types of information involved, steps the organization is taking to investigate and prevent future incidents, and recommended actions patients should take to protect themselves. Given the November 13, 2024 submission date, affected individuals would have been notified by mid-January 2025 at the latest, though notification likely occurred sooner. ## Industry Context and HIPAA Implications Physical loss of healthcare records remains a persistent vulnerability in the healthcare industry despite decades of HIPAA enforcement. The HIPAA Security Rule requires covered entities and business associates to implement physical safeguards including facility access controls, workstation security, and device and media controls to protect electronic PHI, while the Privacy Rule extends protections to all PHI regardless of format. Physical losses of paper records and films represent failures in the device and media controls component of the Security Rule, which specifically addresses the physical security of storage media containing PHI. According to HHS breach notification data, losses of physical media account for a significant percentage of healthcare breaches annually, often involving materials lost during transport, at off-site storage facilities, or through inadequate inventory controls. The involvement of a business associate in this incident underscores the importance of Business Associate Agreements (BAAs) that clearly delineate responsibility for maintaining physical security controls and establishing breach notification procedures.