Healthgrades Operating Company

Profile narrative

Healthgrades Operating Company, also known simply as Healthgrades, operates as a digital health information company that connects patients with physicians and hospitals. The company maintains an online platform where users can search for healthcare providers by specialty, location or insurance acceptance, view detailed physician profiles that include education, board certifications and patient‑submitted ratings, and compare hospital performance metrics such as complication rates and patient experience scores. In addition to the consumer‑facing site, Healthgrades offers a suite of data and analytics products designed for hospitals, health systems and physician practices, including reputation management tools, patient acquisition campaigns and market‑insight reports derived from aggregated survey and claims data. These provider‑focused services help organizations understand how patients perceive their care, identify areas for improvement and tailor outreach efforts to attract new patients. As part of its service offerings, the company also maintains archived servers that store historical patient information on behalf of medical centers that previously used its platforms, a function that requires the handling of protected health information. The archived data can include names, addresses, demographic details, Social Security numbers, medical record numbers, treatment codes, insurance information and limited clinical data such as diagnosis or procedure codes. By aggregating and delivering both consumer‑oriented ratings and provider‑oriented analytics, Healthgrades positions itself as an intermediary that supports transparency in the healthcare market while enabling data‑driven decision making for healthcare organizations. The company’s headquarters is located in the United States, although the specific city is not disclosed in the available sources. Its core business model relies on collecting, normalizing and distributing health‑related information to serve both patients seeking care and providers seeking to understand and improve their service delivery.

On October 16 2020, Healthgrades disclosed that an unauthorized individual had gained access to one of its archived servers and exfiltrated historical patient data belonging to a medical center that had formerly contracted with the company for data‑hosting services. The compromised information encompassed a broad range of personal identifiers and health‑related details, including names, addresses, demographic characteristics, Social Security numbers, medical record numbers, treatment codes, insurance particulars and limited clinical data such as diagnosis or procedure codes. Upon discovering the breach, Healthgrades notified the affected medical center, engaged law‑enforcement authorities and conducted an internal investigation that concluded the incident was isolated to its own systems and did not extend to the healthcare provider’s internal networks. The vendor affirmed that no residual patient data remained on its servers after the incident and, as a precautionary measure, offered complimentary credit monitoring services to all individuals whose information had been exposed. Because the exposed data included protected health information, the episode highlights Healthgrades’ status as a business associate subject to the Health Insurance Portability and Accountability Act (HIPAA) and its attendant breach‑notification requirements. The company’s response—prompt notification, cooperation with regulators and provision of remedial services—reflects the standard expectations for entities handling sensitive health data under federal privacy law. While the breach did not result in detected misuse of the compromised data, it underscored the ongoing security challenges faced by organizations that maintain large repositories of historical patient records. No further details about the company’s ownership structure, total employee count, annual revenue or market share are provided in the source material, so those aspects remain unspecified in this profile. Taken together, the described activities and the breach response constitute the verifiable facts available about Healthgrades Operating Company.

Incidents

1 incident linked to this organisation.