Broadwest Specialty Surgical Center Data Breach 2025: 536 Affected · Hacking/IT Incident · IN. Filed With HHS OCR. What To Do.

Broadwest Specialty Surgical Center, an ambulatory surgery center in Merrillville, Indiana, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on June 17, 2025, reporting 536 affected individuals in a Hacking/IT Incident at a network server. Public reporting and law-firm investigations describe notification letters that began reaching affected patients shortly after the OCR filing, with the entity disclosing that names, Social Security numbers, and medical information were potentially exposed.

The OCR portal entry remains the federal regulatory record; the entity has not published an extensive substitute notice on its own website, and the incident has not yet drawn an attributed threat-actor claim or a filed class-action complaint. Federman & Sherwood, a plaintiffs’ firm, has opened an investigation and is soliciting affected individuals.

Timeline

• June 17, 2025 — Broadwest Specialty Surgical Center files a breach notification with HHS OCR. The portal entry categorizes the incident as a Hacking/IT Incident affecting a network server and reports 536 individuals affected.
• Late June 2025 — Affected individuals begin receiving notification letters. Public reporting indicates the letters describe the incident, list the categories of data involved, and provide guidance on credit-monitoring and identity-protection steps.

What was exposed

According to publicly available reporting on the notification letters and the OCR portal entry, the data potentially involved includes:

• Names
• Social Security numbers
• Medical information / protected health information

Specific subcategories of medical data (diagnoses, procedure records, insurance identifiers) are not enumerated in the publicly available materials we have reviewed. The OCR portal entry itself lists only “Network Server” as the location of breached information.

What Broadwest is offering

Public reporting on the entity’s notification letters indicates affected individuals were given steps for credit monitoring and identity protection. The duration, provider, and enrollment deadline for any complimentary credit-monitoring offering are not publicly summarized in the sources we have reviewed; check your individual notification letter for the specifics that apply to your case.

Class-action and regulatory status

As of this writing, no class-action complaint has been publicly filed against Broadwest Specialty Surgical Center in connection with this incident, and no settlement has been announced. Federman & Sherwood has publicly opened an investigation. The OCR portal entry remains open; OCR has not announced a resolution agreement or civil monetary penalty.

What to do if you may be affected

• Read your notification letter carefully. It is the most reliable description of which categories of your data were involved and which credit-monitoring offering, if any, applies to you. Enroll in any complimentary monitoring before the enrollment deadline.
• Freeze your credit with the three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). It is free, takes about ten minutes per bureau, and is the highest-leverage single step against new-account identity theft when a Social Security number has been potentially exposed.
• Watch your medical insurance Explanation of Benefits statements for services you did not receive. Medical identity theft is the harder-to-detect downside of breaches that involve protected health information, and it often does not show up on conventional credit monitoring.
• Keep the notification letter. If you later receive a class-action notice or want to pursue a claim, you will need the letter as proof you were an affected individual.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Federman & Sherwood — Broadwest Specialty Surgical Center Data Breach Investigation — plaintiffs’ firm investigation page summarizing the data categories reportedly involved and the notification-letter timeline.
• Indiana Department of Health — Ambulatory Surgical Center Consumer Report (Broadwest) — state regulatory record confirming the entity’s identity and Merrillville, IN location.
• Better Business Bureau — Broadwest Specialty Surgical Business Profile — corroborating profile of the entity.
• Broadwest Specialty Surgical Center — Entity website — the surgery center’s own website.