Henry County Hospital has notified patients that their personal information may have been exposed in a data breach. The breach did not occur on the hospital’s own systems, but rather at Aesto Health, a third-party vendor the hospital relies on for healthcare data services, a reminder that a hospital’s data security obligations extend to the outside companies entrusted with patient information.
Henry County Hospital’s Data Breach Investigation
According to a notice posted by the vendor, patient information held by Henry County Hospital was compromised in a security incident at Aesto Health, a third-party data services provider based in Birmingham, Alabama that manages data archiving and exchange for healthcare organizations. The breach occurred on December 18, 2025, when the vendor’s systems were accessed by an unauthorized party. Information exposed in the breach reportedly included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, and Social Security numbers, with Social Security numbers reportedly involved for a limited number of individuals. Affected individuals were notified by mail after Aesto Health disclosed the incident to the covered healthcare organizations it serves, including Henry County Hospital.
Breaches originating at a shared third-party vendor are an increasingly common way patient data ends up exposed, since hospitals and healthcare practices routinely depend on outside companies for services such as records archiving, data migration between electronic health record systems, billing, and IT support. When a vendor serving many healthcare organizations is compromised, patients of several unrelated hospitals and practices can be affected at the same time, even though those patients have no direct relationship with the vendor itself. This is one reason HIPAA requires healthcare providers to maintain business associate agreements governing how vendors protect the patient data they are given access to.
The range of data reportedly involved in this incident is significant. Social Security numbers combined with driver’s license numbers and financial account information give criminals substantially more material to attempt identity theft or open fraudulent accounts than any single data point alone, while medical information exposed alongside identifying details can also be misused for insurance fraud. Patients affected by a breach involving this combination of data types are generally encouraged to take a broader set of protective measures than they might for a breach limited to names and addresses.
Notification timelines following a vendor-caused breach can also take longer to unfold than a single-organization incident, since the vendor must first identify every downstream healthcare organization whose patients were affected before those organizations can notify their own patients in turn. This layered notification process is a routine part of how multi-client vendor breaches are handled, not evidence of unusual delay on the part of the hospital.
When Did This Breach Occur?
The breach at Aesto Health occurred on December 18, 2025. Affected Henry County Hospital patients were notified by mail once the incident was confirmed and disclosed.
What Information Was Breached?
According to the notice, information reportedly exposed included patients’ names, dates of birth, medical information, driver’s license numbers, financial account numbers, and, for a limited number of individuals, Social Security numbers.
What You Can Do
If you received a notification letter connected to this breach, consider the following steps:
- Monitor your credit reports and financial accounts for suspicious activity
- Consider placing a fraud alert or credit freeze with all three major credit bureaus
- Be alert to phishing emails or calls referencing the breach or your medical care
- Change passwords on any potentially affected accounts and enable two-factor authentication where available
- Keep a copy of your data breach notification letter for your records
File a Data Breach Lawsuit Against Henry County Hospital
If you are a patient of Henry County Hospital and received a data breach notification letter, or believe your information may have been exposed in this incident, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
