A Tennessee hospital operator has told federal regulators that roughly 67,000 people were caught up in an intrusion that never touched its own network.
Lexington Hospital Corp. notified the HHS Office for Civil Rights on September 8, according to teiss. The trail leads to Aesto LLC, a contractor doing data migration, archiving and historical records work for the group. Between roughly December 2 and December 18, 2025, an unauthorized actor may have reached personal and protected health information held on Aesto’s systems.
The group has not published the specific data types involved, saying only that names, contact details, health records and medical information may have been exposed. Affiliated providers include Henderson County Community Hospital, Henderson County Medical Group and Lexington Family Physicians RHC. The Shamis and Gentile firm says it is investigating.
Archival and migration vendors are a quiet structural risk in healthcare. They hold bulk copies of old records, often outside the covered entity’s logging and monitoring, and access is granted broadly so conversion projects can proceed. A compromise there exposes years of historical PHI at once, and patients learn about it only when the client files.
Compliance teams should be asking archive vendors how access to client datasets is segmented, whether bulk exports are logged and reviewed, and when retention copies are actually destroyed after a migration closes. Contract language requiring breach notice within days rather than months matters when the vendor, not the hospital, controls the evidence.
