Vendors Veradigm and ApolloMD Report Health Data Hacks

Vendor security risk has long been a source of pain for many healthcare providers. Veradigm – formerly Allscripts – and ApolloMD are the latest practice and revenue cycle management software and services vendors reporting hacking incidents to regulators triggering headaches for healthcare providers and their patients.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Veradigm this week began to notify regulators in several states of a hacking incident originating with a compromised customer credential.

Veradigm in its breach notice said that on July 1 it discovered some customers’ data had been accessed by an unauthorized actor. “Veradigm learned that following a data security incident targeting one of its customers, the unauthorized party used a credential obtained from that customer to access a Veradigm storage unit,” the company said.

“Although the incident occurred around Dec. 15, 2024, Veradigm only became aware of it recently through a third-party investigating the original data security incident involving the impacted customer,” Veradigm said.

Data compromised in the Veradigm breach varies among individuals but potentially includes name, data of birth, contact information, health information such as diagnoses and treatments, Social Security numbers, health insurance information, payment details and drivers’ license numbers.

Veradigm said it retained cybersecurity experts “to conduct a thorough review of the impacted storage account and allocated significant resources to help ensure that the solutions Veradigm provides to its customers are secure.”

The company said it also implemented “new technical safeguards and other measures to further reduce the likelihood of a similar event in the future.”

Veradigm in a statement to Information Security Media Group said it recently learned that the patient data “of some of our corporate customers” was accessed by an unauthorized party.

“This incident did not affect Veradigm’s primary network, customer systems actively used by providers, or daily operations. We have begun to notify affected patients and have notified the appropriate authorities.”

Veradigm declined ISMG’s request for other details about the breach, including the identity of the customer whose credentials were compromised on the onset of the incident, and the number of customers and individuals affected.

As of Wednesday, the Veradigm incident had not yet been posted to the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing major data breaches affecting 500 or more individuals.

But so far, breach reports Veradigm filed to the attorneys general in states including South Carolina and Texas indicate the incident affected nearly 70,000 patients in just those two states alone.

ApolloMD Breach

Atlanta-based ApolloMD Business Services in a breach notice said it recently began notifying affiliated physician practices of a data security incident that potentially involved unauthorized access and acquisition of patient information.

ApolloMD’s notice includes a list of about a dozen physician practices affected by the incident including Passaic Hospitalist Services, Pensacola Hospitalist Physicians, Broad River Physicians Group, Olive Branch Emergency Physicians, Aurora Emergency Physicians, Passaic River Physicians, The Bortolazzo Group, Methodist University Emergency Physicians, Trinity Emergency Physicians, Lorain Emergency Physicians and Pennsylvania Hospitalist Group.

ApolloMD said it first became aware of the incident on May 22 after detecting unusual activity in its IT environment. The company engaged third-party experts to investigate the incident, which ApolloMD also reported to law enforcement.

The investigation found that threat actors accessed and acquired files from ApolloMD’s IT environment between May 22 and May 23. The compromised data includes information for patients treated by ApolloMD-affiliated physicians and practices.

The information affected varied by patient but potentially includes name, date of birth, address, diagnosis information, provider names, dates of service, treatment information, health insurance information and Social Security number.

ApolloMD did not immediately respond to ISMG’s request for comment and additional details about the incident. As of Wednesday, the incident was not yet posted on the HHS OCR HIPAA breach reporting website.

Business Associate Risks

As of Wednesday, the HHS Office for Civil Rights’ HIPAA breach reporting website lists 537 major health data breaches affecting more than 41.8 million people so far in 2025.

Of those, more than one-third of the breaches – 196 incidents – involved business associates. Those incidents affected more than 17.5 million people, or about 42% of the individual victims affected by major health data breaches so far this year.

As of Wednesday, the largest HIPAA breach posted on the HHS OCR website so far in 2025 involving a business associate and affecting more than 5.4 million people was reported by Episource, a medical coding unit of health insurer UnitedHealth Group (see: UnitedHealth Group’s Latest Health Data Breach Woes).

Medusind, another revenue cycle management software vendor, also ranked among the five largest breaches reported so far in 2025 by a business associate.

Medusind just recently agreed to a $5 million settlement in proposed class action litigation involving a December 2023 hacking incident, which was reported to HHS OCR in January as affecting nearly 701,500 individuals (see: Accounting Firm Notifying 217,000 of Health Data Hack).

“Lawsuits by breach victims are the most active HIPAA enforcers,” said regulatory attorney Paul Hales of the Hales Law Group.

“Inadequate health information privacy and security safeguards among small HIPAA-regulated entities are significant, well-known concerns,” he said. The security risk to protected health information involving critical vendors to those small practices raises the stakes as well.

“Technical safeguards, by themselves, are not sufficient. Workforce training is essential. Social engineering is the most significant cybersecurity threat,” he said.

Even the largest and seemingly most mature HIPAA business associates can pose tremendous risk to their customers. The February 2024 ransomware attack on Change Healthcare – the IT services unit of UnitedHealth Group – disrupted the business and patient care operations of thousands of healthcare practices for months, and resulted in a record-breaking data breach affecting 193 million patients (see: Change Healthcare Now Counts 190 Million Data Breach Victims).

“No matter how large or small the organization, protecting PHI privacy and security is a responsibility they should take very seriously,” Hales said.