Episource breach: 6.7 million records exposed in hacking incident
Healthcare administrators using Episource, LLC for medical coding or risk-adjustment services should review their contracts and security protocols immediately. This Business Associate reported a hacking/IT incident to HHS OCR on June 6, 2025. The breach exposed the protected health information of 6,725,572 individuals stored on a network server. Because Episource acts as a vendor rather than a direct provider, your organization’s liability depends on your specific business associate agreement. Verify if your entity’s data was included in this massive exposure and confirm that Episource is providing required breach notifications to your patients if necessary.
Sources differ:
- The HHS OCR breach portal lists 6,725,572 individuals for Episource, LLC; HIPAA Journal's coverage reports a total of at least 5,418,866 individuals.