87 Skilled Nursing Facilities Affected by Fundamental Administrative Services Data Breach

Fundamental Administrative Services, LLC located in Sparks, Maryland, reported the potential compromise of the protected health information (PHI) of 56,235 individuals due to a cyberattack. The healthcare management services firm operates over 85 skilled nursing facilities and rehab centers in Maryland, Indiana, New Mexico, Nevada, South Carolina, Wisconsin, and Texas, .

The company discovered suspicious system activity on or about January 13, 2025, and took immediate action to protect its systems and control the attack. It started a forensic investigation to find out the nature and extent of the data breach, which confirmed that the attacker accessed its system for approximately 2.5 months between October 27, 2024 and January 13, 2025. In that period, the attacker extracted files from the system that included HIPAA-protected information.

The file analysis revealed that the breached data included names, birth dates, driver’s license numbers/state ID numbers, Social Security numbers, financial account data, medical treatment data, medical insurance details, and Medicaid/Medicare plan names. Fundamental Administrative Services stated it is going over its guidelines, procedures, and processes associated with its data storage and access.

Fundamental Administrative Services initially reported the data breach to the HHS’ Office for Civil Rights with a placeholder figure of 500 impacted individuals. Now that the file review is done, it updated the breach report.

The table below lists the skilled nursing facilities and rehab centers impacted by the attack:

Image credit: yukinoshirokuma, AdobeStock