Montana healthcare breach data

A breach can involve an organization located in one state while notices about the same event appear through several other states. This page keeps those apart: 4 events involve an organization located in Montana, and 3 appear through Montana notice activity. Reconciled from 7 source records under Canonical Data Model 1.1.

Events at organizations located in Montana

Events with Montana notice activity

181.9K

Reported affected, event totals

Hacking / IT incident

Most common mechanism

The two counts above answer different questions and are not added together: one says the breached organization is located in Montana, the other says a notice about the event appears through Montana. Neither states where an incident physically happened, which these sources do not establish. Reported affected is an event total, not a count of Montana residents: unless a source scopes its figure to one state, it covers everyone the breach affected anywhere. For the same reason state figures do not sum to the national total — one breach reported through several jurisdictions is one event appearing under each of them. How these numbers are calculated.

Recent events

Latest breach events reported in Montana

Oct 17, 2025·5,617 reported affected·Hacking / IT incident·1 source record
Sapphire Community Health
Reported to HHS OCR.
Aug 1, 2025·8,255 reported affected·Hacking / IT incident·1 source record
Western Montana Clinic PC
Reported to HHS OCR.
May 19, 2025·21,243 reported affected·Hacking / IT incident·1 source record
Community Hospital of Anaconda
Reported to HHS OCR.
Nov 14, 2024·86,758 reported affected·Hacking / IT incident·1 source record
Western Montana Mental Health Center
Reported to HHS OCR.
Date not reported·55,000 reported affected·Unknown mechanism·1 source record
Montana Department of Public Health and Human Services
Montana DPHHS reported a breach linked to a cyberattack on Managed Care of North America (MCNA) Dental, a third-party vendor. The breach exposed personal and health information of Montana residents.
Date not reported·2,500 reported affected·Unknown mechanism·1 source record
Mountain State Medical Group
A server misconfiguration unintentionally exposed patient billing records to the public internet.
Date not reported·2,500 reported affected·Phishing / social engineering·1 source record
Mountainview Medical Center
Unauthorized access to patient records due to a phishing attack.

Most affected entities

Organizations in Montana by breach events

Western Montana Mental Health Center

event

86.8K

reported affected

Montana Department of Public Health and Human Services

event

55K

reported affected

Community Hospital of Anaconda

event

21.2K

reported affected

Western Montana Clinic PC

event

8.3K

reported affected

Sapphire Community Health

event

5.6K

reported affected

Incident mechanisms

How breaches happen in Montana

How the 7 canonical breach events with a Montanasource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident4 (57%)
Unknown mechanism2 (29%)
Phishing / social engineering1 (14%)

Montana compliance requirements

Montana breach notification law

Beyond federal HIPAA requirements, Montana has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

Mont. Code Ann. § 30-14-1704(1)

Notification deadline

Without unreasonable delay following discovery of the breach of the security of the data, consistent with (i) the legitimate needs of law enforcement as provided in § 30-14-1704(3), and (ii) any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound.

State regulator notice

Required

Any entity required to issue notification under § 30-14-1704 must SIMULTANEOUSLY submit an electronic copy of the notification AND a statement providing the date and method of distribution of the notification (excluding personal information of an individual) to the Montana Attorney General's Consumer Protection Office. This obligation applies to ALL breaches requiring individual notice — there is NO numeric threshold.

Montana AG-simultaneous-notice at § 30-14-1704(8) has NO numeric threshold

Unlike states that set a > 500 or > 1,000-resident numeric threshold for state-agency breach notice, Montana's § 30-14-1704(8) requires SIMULTANEOUS notice to the Montana Attorney General's Consumer Protection Office for ALL breaches requiring individual notice — including small breaches affecting fewer than 100 Montana residents. For a HIPAA-regulated healthcare practice operating in Montana, this means any breach involving PHI within § 30-14-1704's scope (which includes 'medical record information') triggers both individual notice and simultaneous Montana AG Consumer Protection Office notice.

Medical record information is a covered data element in Montana's PI definition — but a HIPAA breach is not automatically a Montana-notifiable breach

Mont. Code Ann. § 30-14-1704(4)(b)(i)(D) expressly includes 'medical record information as defined in 33-19-104' within the section's personal-information definition, so healthcare data-category is not itself a scope escape from § 30-14-1704. But the presence of medical record information does not automatically make a HIPAA breach a Montana-notifiable breach. § 30-14-1704 has its own gates — the incident must satisfy Montana's breach, data-element, encryption, acquisition, and harm conditions independently. A HIPAA breach that meets HHS's 45 CFR § 164.402 test may or may not meet § 30-14-1704's independent elements in the specific incident, and each should be assessed on its own terms. Where § 30-14-1704 is triggered, its (8) simultaneous AG-notice obligation applies on the same event.

2025-2026 currentness note

Mont. Code Ann. § 30-14-1704 substantive text confirmed against mca.legmt.gov Montana Legislative Services Division's primary-source publication on 2026-08-23. Section amendments: 2007 Ch. 180, Sec. 3; 2015 Ch. 62, Sec. 3. No 2025 or 2026 Montana amendments to § 30-14-1704 were identified in this session's primary-source review. If a future Montana session amends § 30-14-1704 or related provisions in Title 30 Chapter 14 Part 17, this record must be re-verified.

This is a general reference based on current Montana law. Consult legal counsel for state-specific compliance obligations. Source: Mont. Code Ann. § 30-14-1704(1). Per-jurisdiction verification status and primary-source references are shown on each specialty/state compliance page.

Protect your Montana practice

7 breach events in Montana. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in Montana

How many healthcare data breaches have been reported in Montana?

4 canonical breach events involve an organization located in Montana, and 3 appear through Montana notice activity. Those are different relationships and are not added together — a breach at an organization elsewhere can be notified through Montana. Together the events on this page report 181.9K individuals affected, an event total counting everyone each breach affected anywhere, not a count of Montana residents. Sourced from HHS OCR breach reports and state attorney general notices, reconciled under Patient Protect Canonical Data Model 1.1. Updated nightly.

What is the most common breach mechanism in Montana?

The most frequently reported incident mechanism in Montana is Hacking / IT incident, present in 4 of 7 canonical breach events. Unknown mechanism follows with 2.

Are independent practices in Montana at higher risk?

Independent healthcare practices are the fastest-growing target for healthcare cyberattacks nationwide — attacks on small providers have increased 6x since 2021. Montana practices face the same threat landscape with fewer resources to defend against it. Patient Protect provides breach prevention specifically for independent practices starting at $39/month.

What are Montana's breach notification requirements?

Montana requires breach notification without unreasonable delay following discovery of the breach of the security of the data, consistent with (i) the legitimate needs of law enforcement as provided in § 30-14-1704(3), and (ii) any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound, and requires notice to the state regulator identified in the statute. These requirements apply alongside federal HIPAA's 60-day notification deadline. Reference: Mont. Code Ann. § 30-14-1704(1).

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Data Disclaimer: This page counts canonical breach events reconciled from the HHS OCR Breach Portal and state attorney general breach notifications under Patient Protect Canonical Data Model 1.1. Regulatory enforcement actions, security advisories, community reports and algorithmically modeled records are held separately and are not counted here. Data is provided “as-is” for informational purposes only. Inclusion of any entity does not imply wrongdoing. Users must independently verify information before relying on it. See Terms of Use.

Montana healthcare breach data

Events at organizations located in Montana

Events with Montana notice activity

181.9K

Reported affected, event totals

Hacking / IT incident

Most common mechanism

Recent events

Latest breach events reported in Montana

Oct 17, 2025·5,617 reported affected·Hacking / IT incident·1 source record
Sapphire Community Health
Reported to HHS OCR.
Aug 1, 2025·8,255 reported affected·Hacking / IT incident·1 source record
Western Montana Clinic PC
Reported to HHS OCR.
May 19, 2025·21,243 reported affected·Hacking / IT incident·1 source record
Community Hospital of Anaconda
Reported to HHS OCR.
Nov 14, 2024·86,758 reported affected·Hacking / IT incident·1 source record
Western Montana Mental Health Center
Reported to HHS OCR.
Date not reported·55,000 reported affected·Unknown mechanism·1 source record
Montana Department of Public Health and Human Services
Montana DPHHS reported a breach linked to a cyberattack on Managed Care of North America (MCNA) Dental, a third-party vendor. The breach exposed personal and health information of Montana residents.
Date not reported·2,500 reported affected·Unknown mechanism·1 source record
Mountain State Medical Group
A server misconfiguration unintentionally exposed patient billing records to the public internet.
Date not reported·2,500 reported affected·Phishing / social engineering·1 source record
Mountainview Medical Center
Unauthorized access to patient records due to a phishing attack.

Most affected entities

Organizations in Montana by breach events

Western Montana Mental Health Center

event

86.8K

reported affected

Montana Department of Public Health and Human Services

event

55K

reported affected

Community Hospital of Anaconda

event

21.2K

reported affected

Western Montana Clinic PC

event

8.3K

reported affected

Sapphire Community Health

event

5.6K

reported affected

Incident mechanisms

How breaches happen in Montana

How the 7 canonical breach events with a Montanasource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident4 (57%)
Unknown mechanism2 (29%)
Phishing / social engineering1 (14%)

Montana compliance requirements

Montana breach notification law

Beyond federal HIPAA requirements, Montana has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

Mont. Code Ann. § 30-14-1704(1)

Notification deadline

State regulator notice

Required

Montana AG-simultaneous-notice at § 30-14-1704(8) has NO numeric threshold

Medical record information is a covered data element in Montana's PI definition — but a HIPAA breach is not automatically a Montana-notifiable breach

2025-2026 currentness note

Protect your Montana practice

7 breach events in Montana. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in Montana

How many healthcare data breaches have been reported in Montana?

What is the most common breach mechanism in Montana?

The most frequently reported incident mechanism in Montana is Hacking / IT incident, present in 4 of 7 canonical breach events. Unknown mechanism follows with 2.

Are independent practices in Montana at higher risk?

What are Montana's breach notification requirements?

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Montana healthcare breach data

Latest breach events reported in Montana

Sapphire Community Health

Western Montana Clinic PC

Community Hospital of Anaconda

Western Montana Mental Health Center

Montana Department of Public Health and Human Services

Mountain State Medical Group

Mountainview Medical Center

Organizations in Montana by breach events

Western Montana Mental Health Center

Montana Department of Public Health and Human Services

Community Hospital of Anaconda

Western Montana Clinic PC

Sapphire Community Health

How breaches happen in Montana

Montana breach notification law

Montana AG-simultaneous-notice at § 30-14-1704(8) has NO numeric threshold

Medical record information is a covered data element in Montana's PI definition — but a HIPAA breach is not automatically a Montana-notifiable breach

2025-2026 currentness note

7 breach events in Montana. Is your practice next?

Healthcare breaches in Montana

How many healthcare data breaches have been reported in Montana?

What is the most common breach mechanism in Montana?

Are independent practices in Montana at higher risk?

What are Montana's breach notification requirements?

Montana healthcare breach data

Latest breach events reported in Montana

Sapphire Community Health

Western Montana Clinic PC

Community Hospital of Anaconda

Western Montana Mental Health Center

Montana Department of Public Health and Human Services

Mountain State Medical Group

Mountainview Medical Center

Organizations in Montana by breach events

Western Montana Mental Health Center

Montana Department of Public Health and Human Services

Community Hospital of Anaconda

Western Montana Clinic PC

Sapphire Community Health

How breaches happen in Montana

Montana breach notification law

Montana AG-simultaneous-notice at § 30-14-1704(8) has NO numeric threshold

Medical record information is a covered data element in Montana's PI definition — but a HIPAA breach is not automatically a Montana-notifiable breach

2025-2026 currentness note

7 breach events in Montana. Is your practice next?

Healthcare breaches in Montana

How many healthcare data breaches have been reported in Montana?

What is the most common breach mechanism in Montana?

Are independent practices in Montana at higher risk?

What are Montana's breach notification requirements?

Latest verified Responses

CareCloud breach filing: what a revised scope means for vendor oversight

Madera Community Hospital breach filing: 150,000 individuals and exfiltration-scoped risk analysis

Brown Health Medical Group breach filing: 311,760 individuals and server-side safeguards