Avamere Health Services Data Breach Impacts 96 Practices, At Least 380K

July 29, 2022 - Avamere Health Services, a group of independently-owned post-acute care companies that provide care for seniors, reported a data breach that impacted 96 practices and at least 380,000 individuals.

According to a notice on its website, Avamere discovered unauthorized access to a third-party hosted network between January 19, 2022 and March 17, 2022. Avamere launched an investigation, which later revealed that an unauthorized party had removed a limited number of files and folders from its network.

The folders and files included names, addresses, driver’s license or state identification numbers, claims information, lab results, medication information, Social Security numbers, financial account numbers, and medical diagnosis information.

Avamere reported the breach to HHS on behalf of 81 organzations, showing that it impacted 197,730 individuals. One of the impacted organizations, Infinity Rehab, also reported the breach on behalf of an additional 15 organizations, noting that it impacted 183,254 individuals. At the time of publication, only Avamere Health Services and Infinity Rehab had reported the breach independently to HHS.

Avamere Health listed the following 81 organizations that were impacted by the breach:

• A-One Home Health Services, LLC
• Avamere at Albany
• Avamere at Bethany
• Avamere at Cascadia Village
• Avamere at Chestnut Lane
• Avamere at Englewood Heights
• Avamere at Hermiston
• Avamere at Hillsboro
• Avamere at Las Vegas
• Avamere at Lexington
• Avamere at Moses Lake
• Avamere at Mountain Ridge
• Avamere at Newberg
• Avamere at Oak Park
• Avamere at Pacific Ridge
• Avamere at Park Place
• Avamere at Port Townsend
• Avamere at Rio Rancho
• Avamere at Roswell
• Avamere at Sandy
• Avamere at Seaside
• Avamere at Seaside
• Avamere at Sherwood
• Avamere at South Hill
• Avamere at St. Helens
• Avamere at the Stratford
• Avamere at Three Fountains
• Avamere at Waterford
• Avamere at Wenatchee
• Avamere Court at Keizer
• Avamere Crestview of Portland
• Avamere Fern Gardens Memory Care
• Avamere Gresham Rehabilitation and Specialty Care
• Avamere Harmony House of Bend
• Avamere Health Services of Rogue Valley
• Avamere Heritage Rehabilitation of Tacoma
• Avamere Home Health Care, LLC
• Avamere Living at Berry Park
• Avamere Olympic Care of Sequim
• Avamere Rehabilitation at Fiesta Park
• Avamere Rehabilitation of Beaverton
• Avamere Rehabilitation of Cascade Park
• Avamere Rehabilitation of Clackamas
• Avamere Rehabilitation of Coos Bay
• Avamere Rehabilitation of Eugene
• Avamere Rehabilitation of Hillsboro
• Avamere Rehabilitation of Junction City
• Avamere Rehabilitation of King City
• Avamere Rehabilitation of Lebanon
• Avamere Rehabilitation of Newport
• Avamere Rehabilitation of Oregon City
• Avamere Rehabilitation of Richmond Beach
• Avamere Riverpark of Eugene
• Avamere St. Francis of Bellingham
• Avamere Transitional Care and Rehabilitation-Bellingham
• Avamere Transitional Care and Rehabilitation-Boise
• Avamere Transitional Care and Rehabilitation-Brighton
• Avamere Transitional Care and Rehabilitation-Malley
• Avamere Transitional Care at Sunnyside
• Avamere Transitional Care of Puget Sound
• Avamere Twin Oaks of Sweethome
• Bend Transitional Care
• Infinity Rehab
• Laurelhurst Village
• Northwest Hospice, LLC
• NP2U, LLC
• Prime Home Health, LLC
• Queen Anne Healthcare
• Salem Transitional Care
• Signature Coastal, LLC
• Signature Home Health Bend, LLC
• Signature Hospice Eugene, LLC
• Signature Hospice Medford, LLC
• Signature Hospice Nampa, LLC
• Signature Hospice Oregon Coast, LLC
• Suzanne Elise Assisted Living Facility
• The Arbor at Avamere Court
• The Arbor at Bend
• The Arbor at Bremerton
• The Pearl at Kruse Way
• The Stafford

In addition, Infinity Rehab, which referred to Avamere Health Services as its information technology business associate, added the following 15 organizations to the breach tally:

• Bethany at Pacific
• Bethany at Silver Lake
• Cascadia Healthcare
• Christian Living Communities
• Columbia Lutheran Home
• Good Samaritan Society
• Goodman Group
• Kin On Health Care Center
• Mission Healthcare at Bellevue, JV
• Mission Healthcare at Renton
• Pinecrest Community
• Prestige Care
• Rockwood at Hawthorne
• Rockwood South Hill
• Summitview Healthcare Center

“The security and privacy of personal information is of the utmost importance,” Infinity Rehab’s notice stated.

“Since the incident, our Information Technology (‘IT’) department and external security experts have reviewed and enhanced our systems to reduce the chance of a similar event from occurring in the future.”