Berkshire Health Systems, Inc. Data Breach 2025: 1,421 Affected · Insider Snooping at Fairview Hospital · MA. Filed With HHS OCR. What To Do.

Berkshire Health Systems, Inc., the largest healthcare provider in Berkshire County, Massachusetts, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on July 30, 2025, reporting 1,421 affected individuals in an insider-misuse incident involving its electronic medical record system. According to BHS’s notification letter, a former employee in the Surgical Services Department at Fairview Hospital in Great Barrington viewed patient records without a legitimate business purpose. Reporting by the Berkshire Argus and others has documented that unauthorized access may extend back to 2014, when the employee was first hired, although BHS told regulators it would review records only back to October 1, 2022.

Timeline

• 2014: The employee at the center of the incident was hired at Fairview Hospital. BHS has acknowledged to regulators that unauthorized record access may date to this period.
• June 3, 2025: BHS received a report flagging that the Surgical Services employee may have accessed patient records without a legitimate work-related reason. An internal investigation followed.
• July 30, 2025: BHS filed the breach with HHS OCR and notified state attorneys general, including New Hampshire and Connecticut.
• August 12, 2025: BHS began mailing individual notification letters to affected patients.

What was exposed

Per BHS’s notification letter and corroborating reporting, the accessed electronic medical records included:

• Full name
• Date of birth
• Account number
• Diagnosis codes
• Visit notes

BHS has stated the former employee’s access was view-only and that there is no evidence records were downloaded, printed, or further disclosed. Financial information, health insurance information, and Social Security numbers were not viewable in the affected views, according to BHS.

What BHS is offering

BHS’s public notification and the New Hampshire Attorney General filing describe the entity’s response as termination of the employee, optimization of privacy-monitoring software, and review of access logs. The public materials reviewed do not indicate that complimentary credit monitoring or identity-theft protection has been offered to affected patients. If you receive a notification letter that includes a monitoring enrollment code, follow the letter’s instructions directly.

Class-action and litigation status

As of this page’s last update, no class-action lawsuit against Berkshire Health Systems related to this incident has been publicly reported in the sources reviewed. The HHS OCR investigation is open. We will update this page if filings are docketed.

What to do if you may be affected

• Watch for a notification letter addressed to you from Berkshire Health Systems. The letter will identify the specific information involved and explain what, if anything, BHS is offering to enroll in.
• Request your medical-record access log. Under HIPAA’s right of access, you can ask BHS for an accounting of disclosures and, where available, an audit of who viewed your record. This is the most useful step for an insider-snooping incident, because credit freezes do not address the harm.
• Freeze your credit anyway if you have not already. It is free at all three nationwide consumer reporting agencies and is the highest-leverage protection against identity theft if any additional data later turns out to have been exposed.
• Bookmark this page. We update it as new public information becomes available.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• New Hampshire Attorney General — BHS breach notification letter (Aug 4, 2025) — the entity’s own notification letter to a state AG, with exposed-data list and incident description.
• The Berkshire Edge — Berkshire Health Systems patients notified of data breach — local press coverage of the August 12, 2025 patient notifications.
• HIPAA Journal — Insider breaches identified by three healthcare providers — trade-press confirmation of the insider incident and response.
• WAMC — Berkshire Argus investigation — reporting on the decade-long access window and BHS’s limited investigative scope.
• Berkshire Health Systems — Policies and Notices — the entity’s own public notices page.