West Virginia healthcare breach data

A breach can involve an organization located in one state while notices about the same event appear through several other states. This page keeps those apart: 8 events involve an organization located in West Virginia, and 17 appear through West Virginia notice activity. Reconciled from 26 source records under Canonical Data Model 1.1.

Events at organizations located in West Virginia

Events with West Virginia notice activity

454.4K

Reported affected, event totals

Hacking / IT incident

Most common mechanism

The two counts above answer different questions and are not added together: one says the breached organization is located in West Virginia, the other says a notice about the event appears through West Virginia. Neither states where an incident physically happened, which these sources do not establish. Reported affected is an event total, not a count of West Virginia residents: unless a source scopes its figure to one state, it covers everyone the breach affected anywhere. For the same reason state figures do not sum to the national total — one breach reported through several jurisdictions is one event appearing under each of them. How these numbers are calculated.

Recent events

Latest breach events reported in West Virginia

Jul 31, 2026·2,173 reported affected·Hacking / IT incident·1 source record
Monongalia County General Hospital Company
Reported to HHS OCR.
Apr 28, 2026·500 reported affected·Hacking / IT incident·1 source record
FMRS Health Systems, Inc.
Reported to HHS OCR.
Apr 20, 2026·1,000 reported affected·Hacking / IT incident·1 source record
Prime Care 12 Priority Health
Reported to HHS OCR.
Jul 18, 2025·1,300 reported affected·Unauthorized access or disclosure·1 source record
ABC Holding Company
Reported to HHS OCR.
May 3, 2025·4,895 reported affected·Unauthorized access or disclosure·1 source record
Monongalia Health System, Inc.
Reported to HHS OCR.
Apr 22, 2025·2,583 reported affected·Hacking / IT incident·1 source record
Charleston Fire Department
Reported to HHS OCR.
Feb 14, 2025·67,413 reported affected·Hacking / IT incident·1 source record
Charleston Area Medical Center
Charleston Area Medica Center, the covered entity (CE), reported that an employee was the subject of an email phishing incident that compromised the protected health information (PHI) of 67,413 individuals.
Feb 16, 2024·9,013 reported affected·Hacking / IT incident·1 source record
Hospice of Huntington
Reported to HHS OCR.
Date not reported·7,000 reported affected·Hacking / IT incident·1 source record
Appalachian Dental Group
Unauthorized access to dental practice management software, impacting patient demographic and billing data.
Date not reported·7,000 reported affected·Misconfiguration·1 source record
Appalachian Health Solutions
A server misconfiguration exposed patient test results and treatment histories.
Date not reported·45,000 reported affected·Phishing / social engineering·1 source record
Capital Health Care Network
A phishing incident compromised employee email accounts, leading to unauthorized access to patient health information. The incident was discovered on March 1, 2026. Exposed data included patient names, dates of birth, and medical record numbers.
Date not reported·85,000 reported affected·Hacking / IT incident·1 source record
Charleston Area Medical Center (CAMC)
IT system outage and data exfiltration due to a cybersecurity incident.

Most affected entities

Organizations in West Virginia by breach events

Charleston Area Medical Center (CAMC)

event

85K

reported affected

Charleston Area Medical Center

event

67.4K

reported affected

Mountain State University Hospital

event

60K

reported affected

Capital Health Care Network

event

45K

reported affected

Mountain State Medical Devices

event

40K

reported affected

Incident mechanisms

How breaches happen in West Virginia

How the 25 canonical breach events with a West Virginiasource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident9 (36%)
Unauthorized access or disclosure4 (16%)
Phishing / social engineering3 (12%)
Ransomware / malware3 (12%)
Theft or loss3 (12%)
Unknown mechanism2 (8%)
Misconfiguration1 (4%)

West Virginia compliance requirements

West Virginia breach notification law

Beyond federal HIPAA requirements, West Virginia has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

W. Va. Code § 46A-2A-102(a)

Notification deadline

Without unreasonable delay following discovery of the breach of unauthorized access to unencrypted personal information, subject to the specified law-enforcement delay and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

State regulator notice

Not required

None identified in the primary text reviewed. West Virginia's breach-notification chapter (§ 46A-2A-101 et seq.) does not impose an affirmative Attorney General notice obligation on the face of § 46A-2A-102 as extracted this pass. This record's regulator field should be re-verified against §§ 46A-2A-103 through 46A-2A-105 if a live AG-notice question arises.

West Virginia's regulator-notice picture in § 46A-2A-102 requires cross-check with adjacent sections

The primary-source review this pass captured § 46A-2A-102's individual-notice and CRA-notice structure but did not conclusively rule out an AG or state-regulator notice obligation in adjacent sections of §§ 46A-2A-101 through 46A-2A-105. States often place AG-notice obligations in a separate enforcement or notification-content section (as Iowa does at § 715C.2(8), for example). West Virginia practices experiencing a live breach should independently verify the current text of §§ 46A-2A-103 through 46A-2A-105 for any state-agency notice obligation before relying solely on this record's regulator field.

2025-2026 currentness note

W. Va. Code § 46A-2A-102 substantive text confirmed against code.wvlegislature.gov West Virginia Legislature primary-source publication on 2026-08-23. No 2025 or 2026 West Virginia amendments to § 46A-2A-102 were identified in this session's primary-source review. If a future West Virginia session amends § 46A-2A-102 or adjacent provisions in Chapter 46A-2A, this record must be re-verified.

This is a general reference based on current West Virginia law. Consult legal counsel for state-specific compliance obligations. Source: W. Va. Code § 46A-2A-102(a). Per-jurisdiction verification status and primary-source references are shown on each specialty/state compliance page.

Protect your West Virginia practice

25 breach events in West Virginia. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in West Virginia

How many healthcare data breaches have been reported in West Virginia?

8 canonical breach events involve an organization located in West Virginia, and 17 appear through West Virginia notice activity. Those are different relationships and are not added together — a breach at an organization elsewhere can be notified through West Virginia. Together the events on this page report 454.4K individuals affected, an event total counting everyone each breach affected anywhere, not a count of West Virginia residents. Sourced from HHS OCR breach reports and state attorney general notices, reconciled under Patient Protect Canonical Data Model 1.1. Updated nightly.

What is the most common breach mechanism in West Virginia?

The most frequently reported incident mechanism in West Virginia is Hacking / IT incident, present in 9 of 25 canonical breach events. Unauthorized access or disclosure follows with 4.

Are independent practices in West Virginia at higher risk?

Independent healthcare practices are the fastest-growing target for healthcare cyberattacks nationwide — attacks on small providers have increased 6x since 2021. West Virginia practices face the same threat landscape with fewer resources to defend against it. Patient Protect provides breach prevention specifically for independent practices starting at $39/month.

What are West Virginia's breach notification requirements?

West Virginia requires breach notification without unreasonable delay following discovery of the breach of unauthorized access to unencrypted personal information, subject to the specified law-enforcement delay and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. These requirements apply alongside federal HIPAA's 60-day notification deadline. Reference: W. Va. Code § 46A-2A-102(a).

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Data Disclaimer: This page counts canonical breach events reconciled from the HHS OCR Breach Portal and state attorney general breach notifications under Patient Protect Canonical Data Model 1.1. Regulatory enforcement actions, security advisories, community reports and algorithmically modeled records are held separately and are not counted here. Data is provided “as-is” for informational purposes only. Inclusion of any entity does not imply wrongdoing. Users must independently verify information before relying on it. See Terms of Use.

West Virginia healthcare breach data

Events at organizations located in West Virginia

Events with West Virginia notice activity

454.4K

Reported affected, event totals

Hacking / IT incident

Most common mechanism

Recent events

Latest breach events reported in West Virginia

Jul 31, 2026·2,173 reported affected·Hacking / IT incident·1 source record
Monongalia County General Hospital Company
Reported to HHS OCR.
Apr 28, 2026·500 reported affected·Hacking / IT incident·1 source record
FMRS Health Systems, Inc.
Reported to HHS OCR.
Apr 20, 2026·1,000 reported affected·Hacking / IT incident·1 source record
Prime Care 12 Priority Health
Reported to HHS OCR.
Jul 18, 2025·1,300 reported affected·Unauthorized access or disclosure·1 source record
ABC Holding Company
Reported to HHS OCR.
May 3, 2025·4,895 reported affected·Unauthorized access or disclosure·1 source record
Monongalia Health System, Inc.
Reported to HHS OCR.
Apr 22, 2025·2,583 reported affected·Hacking / IT incident·1 source record
Charleston Fire Department
Reported to HHS OCR.
Feb 14, 2025·67,413 reported affected·Hacking / IT incident·1 source record
Charleston Area Medical Center
Charleston Area Medica Center, the covered entity (CE), reported that an employee was the subject of an email phishing incident that compromised the protected health information (PHI) of 67,413 individuals.
Feb 16, 2024·9,013 reported affected·Hacking / IT incident·1 source record
Hospice of Huntington
Reported to HHS OCR.
Date not reported·7,000 reported affected·Hacking / IT incident·1 source record
Appalachian Dental Group
Unauthorized access to dental practice management software, impacting patient demographic and billing data.
Date not reported·7,000 reported affected·Misconfiguration·1 source record
Appalachian Health Solutions
A server misconfiguration exposed patient test results and treatment histories.
Date not reported·45,000 reported affected·Phishing / social engineering·1 source record
Capital Health Care Network
A phishing incident compromised employee email accounts, leading to unauthorized access to patient health information. The incident was discovered on March 1, 2026. Exposed data included patient names, dates of birth, and medical record numbers.
Date not reported·85,000 reported affected·Hacking / IT incident·1 source record
Charleston Area Medical Center (CAMC)
IT system outage and data exfiltration due to a cybersecurity incident.

Most affected entities

Organizations in West Virginia by breach events

Charleston Area Medical Center (CAMC)

event

85K

reported affected

Charleston Area Medical Center

event

67.4K

reported affected

Mountain State University Hospital

event

60K

reported affected

Capital Health Care Network

event

45K

reported affected

Mountain State Medical Devices

event

40K

reported affected

Incident mechanisms

How breaches happen in West Virginia

How the 25 canonical breach events with a West Virginiasource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident9 (36%)
Unauthorized access or disclosure4 (16%)
Phishing / social engineering3 (12%)
Ransomware / malware3 (12%)
Theft or loss3 (12%)
Unknown mechanism2 (8%)
Misconfiguration1 (4%)

West Virginia compliance requirements

West Virginia breach notification law

Beyond federal HIPAA requirements, West Virginia has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

W. Va. Code § 46A-2A-102(a)

Notification deadline

State regulator notice

Not required

West Virginia's regulator-notice picture in § 46A-2A-102 requires cross-check with adjacent sections

2025-2026 currentness note

Protect your West Virginia practice

25 breach events in West Virginia. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in West Virginia

How many healthcare data breaches have been reported in West Virginia?

What is the most common breach mechanism in West Virginia?

The most frequently reported incident mechanism in West Virginia is Hacking / IT incident, present in 9 of 25 canonical breach events. Unauthorized access or disclosure follows with 4.

Are independent practices in West Virginia at higher risk?

What are West Virginia's breach notification requirements?

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

West Virginia healthcare breach data

Latest breach events reported in West Virginia

Monongalia County General Hospital Company

FMRS Health Systems, Inc.

Prime Care 12 Priority Health

ABC Holding Company

Monongalia Health System, Inc.

Charleston Fire Department

Charleston Area Medical Center

Hospice of Huntington

Appalachian Dental Group

Appalachian Health Solutions

Capital Health Care Network

Charleston Area Medical Center (CAMC)

Organizations in West Virginia by breach events

Charleston Area Medical Center (CAMC)

Charleston Area Medical Center

Mountain State University Hospital

Capital Health Care Network

Mountain State Medical Devices

How breaches happen in West Virginia

West Virginia breach notification law

West Virginia's regulator-notice picture in § 46A-2A-102 requires cross-check with adjacent sections

2025-2026 currentness note

25 breach events in West Virginia. Is your practice next?

Healthcare breaches in West Virginia

How many healthcare data breaches have been reported in West Virginia?

What is the most common breach mechanism in West Virginia?

Are independent practices in West Virginia at higher risk?

What are West Virginia's breach notification requirements?

West Virginia healthcare breach data

Latest breach events reported in West Virginia

Monongalia County General Hospital Company

FMRS Health Systems, Inc.

Prime Care 12 Priority Health

ABC Holding Company

Monongalia Health System, Inc.

Charleston Fire Department

Charleston Area Medical Center

Hospice of Huntington

Appalachian Dental Group

Appalachian Health Solutions

Capital Health Care Network

Charleston Area Medical Center (CAMC)

Organizations in West Virginia by breach events

Charleston Area Medical Center (CAMC)

Charleston Area Medical Center

Mountain State University Hospital

Capital Health Care Network

Mountain State Medical Devices

How breaches happen in West Virginia

West Virginia breach notification law

West Virginia's regulator-notice picture in § 46A-2A-102 requires cross-check with adjacent sections

2025-2026 currentness note

25 breach events in West Virginia. Is your practice next?

Healthcare breaches in West Virginia

How many healthcare data breaches have been reported in West Virginia?

What is the most common breach mechanism in West Virginia?

Are independent practices in West Virginia at higher risk?

What are West Virginia's breach notification requirements?

Latest verified Responses

CareCloud breach filing: what a revised scope means for vendor oversight

Madera Community Hospital breach filing: 150,000 individuals and exfiltration-scoped risk analysis

Brown Health Medical Group breach filing: 311,760 individuals and server-side safeguards