A 25-bed critical access hospital on Michigan’s Upper Peninsula is notifying patients nearly six months after an intruder reached its network, closing out an incident that forced one rural emergency room to lean on other facilities.
Baraga County Memorial Hospital reported the intrusion to the HHS Office for Civil Rights on October 1, listing names, addresses, birth dates, Social Security numbers, insurance details, clinical data and treatment records as exposed categories. It did not disclose how many people were affected, and the total is absent from the federal breach portal.
A small county leaning on its neighbors
It serves a thinly populated county on the Lake Superior shore, where the next emergency department is a long winter drive. When a facility that size loses network access, diverting patients and handing off imaging and lab work becomes the only option.
It is also only the largest name in this filing. City Ambulance Service in Texas, The Speech Clinic in Georgia and Innovative Alternatives, also in Texas, are notifying patients in the same round. Each report follows the same shape: a forensic firm engaged, a review wrapped up weeks later, then letters arriving long after the intrusion.
What small hospitals should take from it
Rural providers stay the sector’s softest target, running lean IT staffs, flat networks and clinical systems that cannot simply be replaced. Controls do not change because a hospital is small. Separating medical devices from billing systems, enforcing multifactor authentication on remote entry points and rehearsing a paper downtime process still mark the line between a contained intrusion and weeks of diverted patients.
The notification clock compounds the damage. Sixty days is the outside limit, and a gap stretching from spring to early October is a detail regulators examine closely when they open an investigation.
