HHS OCR report · 2016
Baxter Healthcare data breach
OCR report facts
- Covered entity
- Baxter Healthcare
- Entity type
- Healthcare Provider
- State
- Illinois
- Individuals affected
- 992
- Submission date
- Oct 10, 2016
- Type of breach
- Unauthorized Access/Disclosure
- Location of breached information
- Business associate present
- No
- Status
- Archive (closed)
OCR description
On September 15, 2016, an employee transmitted an email to patients inviting them to participate in a product-specific Patient Advisory Council. The email contained patients’ complete email addresses in the “To” field of the email message, so that recipients could see other recipient’s email addresses, which may have also included names. Approximately 992 individuals were affected by the breach. The covered entity (CE), Baxter Healthcare, provided breach notification to HHS, affected indiv...
Text as published on the HHS OCR breach portal.
Frequently asked questions
How many people were affected by the Baxter Healthcare data breach?
The report to HHS OCR lists 992 individuals affected.
When was it reported to HHS?
It was submitted to HHS OCR on Oct 10, 2016.
What type of breach was it?
The OCR portal lists the type of breach as Unauthorized Access/Disclosure, with the breached information located in: Email.
Is the investigation still open?
No. The report is in the OCR portal archive, which holds reports where OCR has closed its review.
Is a breach notice letter from Baxter Healthcare legitimate?
This site cannot verify letters. Check the sender against the organisation's official website and the HHS OCR breach portal, and avoid calling numbers or clicking links only listed in an unexpected message. See our guide on what to do after a data breach notice.
Source: HHS OCR Breach Portal, OCR export October 2026. Network USA is not affiliated with HHS or Baxter Healthcare.