Banner Health bannerhealth.com Banner Health data breach: what happened and what to do
In 2016 a threat actor hacked Banner Health, a nonprofit health system in Phoenix. HHS says the incident disclosed the health information of 2.81 million consumers, including names, birth dates, Social Security numbers, diagnoses and insurance details.
View all 13,177 breaches- Breach date
- 17 Jun 2016
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Medical information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Banner Health is a nonprofit health system headquartered in Phoenix, Arizona, with more than 50,000 employees across six states. In 2016 a threat actor gained unauthorized access to its systems. The U.S. Department of Health and Human Services (HHS) says the incident disclosed the protected health information of 2.81 million consumers. HHS's Office for Civil Rights (OCR) opened an investigation in November 2016 after receiving the breach report.
Sources checked: hhs.gov, ocrportal.hhs.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS says the hacker accessed patient names, physician names, dates of birth, addresses, Social Security numbers, clinical details, dates of service, claims information, lab results, medications, diagnoses and conditions, and health insurance information.
The settlement
OCR found long-term, pervasive noncompliance with the HIPAA Security Rule. The failures it cites include no organization-wide analysis of risks, too little monitoring of system activity, no authentication process to protect health data, and no protection for data in transit. In February 2023 Banner Health paid $1,250,000 and agreed to a corrective action plan monitored by OCR for two years. Banner Health made no admission of liability.
What it means for you
Social Security numbers, birth dates and addresses together are what criminals need to open credit in your name, and claims and insurance details let someone file false medical claims. Health details also make phishing sound credible.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 3 Aug 2016 : 3,620,000 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Banner Health breach?
HHS says 2.81 million consumers were affected. Banner Health notified affected people, so check for a letter if you were a patient around 2016.
What was exposed?
Names, physician names, birth dates, addresses, Social Security numbers, clinical details, claims information, lab results, medications, diagnoses and insurance information, according to HHS.
Is there a settlement?
Banner Health paid HHS $1,250,000 in February 2023 and agreed to a corrective action plan. HHS's announcement describes a regulatory settlement and doesn't mention payments to patients.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
