- State
- AR
- Covered entity type
- Healthcare Provider
- Individuals affected
- 3,453
- Business associate present
- No
- Type of breach
- Unauthorized Access/Disclosure
- Location of breached information
- Network Server
- First seen by InfoSec Signals
- 9/23/2026
- Last seen in OCR export
- 9/23/2026
OCR description
A physician of the covered entity (CE), Baptist Health, stored patients’ protected health information (PHI) on a cloud-based file sharing application without a business associate (BA) contract in place. The PHI potentially affected included the names, dates of birth, and treatment information of approximately 3,453 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE improved safeguards, updated its policies and procedures, and trained users of its electronic health record system on better practices to protect PHI. OCR obtained assurances that the CE implemented the corrective actions listed.
Change history
- 9/23/2026Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights about this source
Records are reproduced as published; entity names and figures are OCR's.