Marathon Health breach hits nearly 5.7 million with health data
Notifications to U.S. state attorneys general indicate Marathon Health, an employer-sponsored primary care provider, suffered a breach involving personal and protected health information of nearly 5.7 million individuals; the 5,684,735 total comes from law firm Emery Reddy. The company, which operates more than 720 health centers in 41 U.S. states, is not currently listed on the HHS OCR breach portal. Affected individuals should wait for notification letters and monitor their health data.
What happened
Notifications to U.S. state attorneys general indicate Marathon Health, an Indianapolis-based employer-sponsored primary care provider, exposed the personal and protected health information of nearly 5.7 million people in a breach. The company serves more than 600 self-funded employers, labor unions, and public sector organizations through more than 720 health centers in 41 U.S. states.
Why it matters
Protected health information is among the most sensitive data a person has, and exposure can enable medical fraud and targeted scams. Companies offering Marathon Health as a benefit may have employees among those affected and face questions from staff and regulators.
What to do
Client companies should contact Marathon Health to learn whether their employees are among those notified and what data was exposed. Affected individuals should wait for notification letters and monitor their health data.
For the technical team
- Affected
- Marathon Health, provedora americana de atenção primária patrocinada por empregadores · Personal and protected health information (PHI) of nearly 5.7 million individuals. By state: 29,075 Massachusetts residents and 8,858 Vermont residents reported to the respective attorneys general; 234,534 residents listed on the Texas Attorney General website.
- Exploitation
- Breach reported by HIPAA Journal based on notifications to state attorneys general; no misuse of the data has been disclosed.
- Fix
- Not applicable; data breach with no software fix involved.
- Vector
- Not described in the sources; the method, date, and cause of the breach have not been disclosed.
- More details
- Law firm Emery Reddy reports the Texas Attorney General was informed that 5,684,735 individuals are being notified. As a HIPAA-covered entity, Marathon Health must report the case to the HHS Office for Civil Rights, but it is not currently listed on the OCR breach portal. The company has a patient base of around 3 million, about 1,600 providers, more than 720 health centers in 41 states, and virtual care in all 50 states.
Timeline
Incident opened.
