AdaptHealth Cybersecurity Incident: What Patients and Providers Need to Know

AdaptHealth Corp. confirmed on February 22, 2024, that it is investigating a cybersecurity incident involving unauthorized access to its internal systems. The home medical equipment provider stated that a “threat actor” gained entry to a portion of its network, prompting the company to initiate containment protocols and launch an investigation with the assistance of external cybersecurity experts. According to the company’s official filing with the U.S. Securities and Exchange Commission (SEC), the firm took immediate steps to secure its environment and notified law enforcement authorities.

How did the breach occur?

While AdaptHealth has not disclosed the specific entry point of the attackers, the company confirmed that it detected unauthorized activity within its network, leading to a temporary disruption of some operations. The incident, disclosed in an 8-K filing, indicates that the company is working to determine the scope of the unauthorized access. Cybersecurity incidents in the healthcare sector frequently involve ransomware or data exfiltration, though AdaptHealth has yet to confirm whether patient protected health information (PHI) was compromised. The company stated that it is following its established incident response plan to evaluate the potential impact on its data.

What is the potential impact on patients?

As of the most recent public update, AdaptHealth is still in the process of assessing whether personal or health-related information was accessed during the intrusion. The company has not reported any evidence of patient harm, but it remains a primary focus of their internal review. Patients who utilize AdaptHealth services for medical equipment—such as CPAP machines, oxygen therapy, or mobility aids—are often targets for identity theft if their insurance or billing details are exposed. The company has committed to providing further updates if the investigation confirms that individual data was impacted.

What actions is the company taking?

AdaptHealth has engaged third-party cybersecurity specialists to conduct a forensic investigation into the nature and extent of the unauthorized access. According to the SEC filing, the company is also coordinating with federal law enforcement agencies. These steps are standard procedure for publicly traded companies under SEC cybersecurity disclosure rules, which require firms to report material incidents that could impact their financial condition or operational continuity.

What should customers do next?

Until AdaptHealth provides a definitive report on the type of data accessed, customers should remain vigilant for suspicious activity. Experts typically recommend the following steps after a healthcare-related data breach:

• Monitor Financial Statements: Watch for unauthorized charges on insurance Explanation of Benefits (EOB) statements or bank accounts.
• Review Credit Reports: Check for new accounts opened without authorization.
• Exercise Caution: Be wary of unsolicited emails or phone calls claiming to be from AdaptHealth, as attackers often use information from a breach to conduct phishing campaigns.

AdaptHealth has stated it will continue to provide updates as its investigation proceeds. Customers with specific concerns regarding their account status or equipment delivery should monitor the company’s official website for direct notices or contact their local branch for service-related inquiries.