Henry Ford Health

# Henry Ford Health Data Breach Report ## Incident Overview Henry Ford Health, a major healthcare system based in Michigan, experienced an unauthorized access incident involving a desktop computer on its network. The breach was reported to the U.S. Department of Health and Human Services on November 26, 2025, affecting 1,984 individuals. The unauthorized access to the desktop computer resulted in potential exposure of protected health information (PHI) stored on or accessible through that device. This incident represents a significant security event for the organization and its patients, as desktop computers often contain or provide access to sensitive patient records, clinical notes, and administrative data. ## Company Response and Investigation Upon discovery of the unauthorized access, Henry Ford Health initiated an investigation to determine the scope and nature of the breach. The organization worked to identify which patient records may have been compromised through the affected desktop computer and began the process of notifying impacted individuals as required by HIPAA Breach Notification Rule. The submission date of November 26, 2025, indicates that the organization completed its investigation and notification process within a reasonable timeframe. Henry Ford Health likely engaged its information security team and potentially external forensic specialists to determine how the unauthorized access occurred, what data was accessed, and what remedial measures were necessary to prevent future incidents. ## Specific Details of the Breach The breach involved unauthorized access to a desktop computer, which typically indicates either physical access to an unattended or unlocked device, compromised user credentials, or exploitation of software vulnerabilities on the endpoint. Desktop computers in healthcare settings often serve as workstations for clinical staff, administrative personnel, and billing departments, making them potential repositories for sensitive patient information. The fact that this was a single desktop computer suggests the breach may have been limited in scope compared to network-wide incidents, though the number of affected individuals (1,984) indicates the device likely contained or provided access to a substantial patient database or multiple patient records. The unauthorized access classification suggests that someone gained entry to the system without proper authorization, potentially through credential compromise, physical access, or exploitation of security weaknesses. No business associate involvement was noted, indicating this was an internal Henry Ford Health security incident rather than a breach originating from a third-party vendor or contractor. ## Organizational Context Henry Ford Health is one of Michigan's largest integrated healthcare delivery systems, operating multiple hospitals, clinics, and healthcare facilities throughout the state. The organization provides comprehensive healthcare services including emergency care, surgery, oncology, cardiology, and numerous other specialties across a wide geographic area. As a major healthcare system, Henry Ford Health maintains extensive electronic health records (EHRs) and patient databases containing sensitive information on hundreds of thousands of patients. The organization's size and complexity mean that desktop computers throughout the system may have varying levels of security controls, and the breach of a single endpoint highlights the importance of comprehensive endpoint security measures across all devices in a healthcare network. ## Patient Impact and Notifications Approximately 1,984 individuals were notified of the potential unauthorized access to their protected health information. These patients likely received breach notification letters detailing what information may have been exposed, the date of discovery, and recommended actions to protect themselves. The notification process is required under the HIPAA Breach Notification Rule, which mandates that covered entities notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. Patients affected by this incident should assume that their health information may have been viewed or accessed by unauthorized parties, though the specific data types exposed would have been detailed in their individual notification letters from Henry Ford Health. ## Industry Context and HIPAA Implications Unauthorized access incidents involving desktop computers represent a significant category of healthcare data breaches. According to HHS Office for Civil Rights data, endpoint devices including desktop computers, laptops, and workstations are frequent targets for unauthorized access due to their accessibility and the sensitive data they often contain. The HIPAA Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect electronic PHI, including access controls, encryption, and audit logging. Desktop computer breaches often result from inadequate physical security (unattended devices), weak password policies, lack of multi-factor authentication, or failure to implement endpoint detection and response (EDR) solutions. Healthcare organizations are increasingly required to implement zero-trust security models, device encryption, and continuous monitoring to prevent such incidents. The notification of 1,984 affected individuals demonstrates Henry Ford Health's compliance with HIPAA notification requirements, though the incident itself suggests potential gaps in the organization's endpoint security posture that may warrant remediation and enhanced controls.

### Breach Overview Henry Ford Health, one of Michigan's largest and most prominent healthcare systems, reported a data security incident involving unauthorized access to a desktop computer that may have compromised the protected health information of 1,984 individuals. The breach was formally submitted to the U.S. Department of Health and Human Services on November 26, 2024, indicating that the healthcare system discovered unauthorized access or disclosure of patient information stored on or accessible through a desktop computer workstation. This type of incident typically involves either an internal employee accessing records without proper authorization or an external party gaining access to an unlocked or improperly secured workstation containing patient data. ### Company Response and Investigation Following the discovery of the unauthorized access, Henry Ford Health initiated an internal investigation to determine the scope and nature of the breach. The healthcare system would have worked to identify which patient records were potentially accessed, what specific information was involved, and how the unauthorized access occurred. Under HIPAA breach notification requirements, covered entities must notify affected individuals within 60 days of discovering a breach affecting 500 or more individuals, and must also report the incident to the Department of Health and Human Services. The November 2024 submission date suggests the breach was likely discovered in the weeks or months prior, allowing time for the investigation to determine the full extent of the incident before making required notifications. ### Specific Details About Desktop Computer Breaches Desktop computer breaches represent a significant category of healthcare data security incidents, often resulting from inadequate access controls, failure to log out of systems, or compromised user credentials. Unlike network server breaches that may involve sophisticated hacking techniques, desktop computer incidents frequently occur due to physical access vulnerabilities or insider threats. In healthcare settings, desktop computers typically contain or provide access to electronic health record systems, patient scheduling software, billing information, and clinical documentation. The classification of this incident as "Unauthorized Access/Disclosure" rather than theft or hacking suggests that someone gained access to information they were not authorized to view, which could indicate an internal employee accessing records outside the scope of their duties, or potentially an external individual gaining physical access to an unlocked workstation. The fact that no business associate was involved indicates this was an internal system managed directly by Henry Ford Health rather than a third-party vendor's equipment. ### Organizational Context Henry Ford Health is a comprehensive, integrated health system serving Michigan and its surrounding communities. As one of the state's largest healthcare providers, the organization operates multiple hospitals, medical centers, and outpatient facilities throughout southeastern Michigan. The health system provides a full spectrum of services including primary care, specialty medicine, surgical services, emergency care, and advanced medical treatments. With thousands of employees and hundreds of thousands of patients served annually, Henry Ford Health maintains extensive electronic health record systems containing sensitive patient information. The organization's size and reputation make data security incidents particularly significant, as they affect a large patient population that relies on the health system for comprehensive medical care. Healthcare systems of this magnitude typically have strong information security programs, making unauthorized access incidents notable events that prompt reviews of security protocols and access controls. ### Number of People Affected The breach affected 1,984 individuals whose protected health information may have been accessed without authorization. While this represents a relatively contained incident compared to large-scale network breaches affecting hundreds of thousands of patients, nearly 2,000 affected individuals still constitutes a significant privacy violation requiring formal notification under HIPAA regulations. The specific number suggests that the unauthorized access was limited to particular patient records rather than a system-wide compromise, possibly indicating access to specific departments, date ranges, or patient populations. Affected individuals would have received or will receive direct notification from Henry Ford Health explaining what happened, what information may have been accessed, and what steps the organization is taking to prevent future incidents. The notification would also include information about resources available to affected patients and recommended protective measures they can take. ### Personal Information Involved While the specific data elements exposed in this breach have not been publicly detailed, desktop computer breaches in healthcare settings typically involve access to comprehensive patient records. Protected health information commonly stored on or accessible through healthcare desktop computers includes patient names, dates of birth, addresses, phone numbers, email addresses, Social Security numbers, medical record numbers, health insurance information including policy and group numbers, dates of service, treating physicians and healthcare providers, diagnosis codes and medical conditions, treatment information and clinical notes, prescription medication records, laboratory and test results, and billing and payment information. The actual data accessed in this incident would depend on which specific systems and records were available through the compromised desktop computer, what information the unauthorized individual viewed or obtained, and how long the unauthorized access continued before detection. Desktop computers used for patient registration might contain primarily demographic and insurance information, while clinical workstations could provide access to detailed medical histories and treatment records. ### Industry Context and HIPAA Requirements Unauthorized access incidents represent one of the most common types of healthcare data breaches reported to federal regulators. According to the HHS Office for Civil Rights breach portal, unauthorized access and disclosure incidents account for a substantial portion of reported breaches, often involving employees accessing records of family members, friends, celebrities, or other individuals without a legitimate treatment, payment, or healthcare operations purpose. HIPAA's Privacy Rule requires covered entities to implement policies and procedures that limit access to protected health information to only those workforce members who need access to perform their job duties. The Security Rule further requires implementation of technical safeguards including unique user identification, automatic logoff, and audit controls to track system access. Desktop computer security is particularly challenging in healthcare environments where clinicians need quick access to patient information during emergencies, but this operational necessity must be balanced against privacy protections. Many healthcare organizations have implemented additional security measures in recent years, including automatic screen locks after brief periods of inactivity, role-based access controls that limit what information different users can view, and enhanced audit logging to detect inappropriate access patterns.