MedStar St. Mary's Hospital

MedStar St. Mary's Hospital (MD) reported to HHS OCR that its business associate experienced a cybersecurity attack affecting PHI of 172,915 individuals. Compromised data included names, addresses, dates of birth, driver's license numbers, Social Security numbers, diagnoses/conditions, lab results, medications, and health insurance information. The breach was reported on 2025-05-29 and involved a network server. Response included HHS, individual, and media notifications, substitute notice, complimentary credit monitoring, and implementation of additional safeguards. The specific business associate is not named in the OCR portal entry.

Affected (this filing): 172,915