Edwards County Medical Center has notified patients that an unauthorized actor may have accessed their personal and health information during a security incident at Aesto, LLC, a third-party vendor that manages the hospital's data.

 

What happened

Edwards County Medical Center, a critical access hospital in Kinsley, Kansas, relies on Aesto, LLC (also known as Aesto Health), a Birmingham, Alabama-based healthcare technology company, for data migration, legacy data archiving, and electronic health record exchange services. Aesto experienced a network security incident that impacted a limited portion of its Amazon Web Services infrastructure. Aesto confirmed on May 26, 2026, after a forensic investigation and manual review of affected files, that an unauthorized actor may have accessed or acquired sensitive information belonging to patients of Edwards County Medical Center and other healthcare providers that use Aesto's services. The unauthorized access occurred between December 2 and December 18, 2025. Aesto notified Edwards County Medical Center of the incident on June 26, 2026, and the hospital began mailing notification letters to affected patients on or around August 26, 2026.

 

Going deeper

Amazon Web Services (AWS) is a cloud computing platform that businesses, including healthcare vendors like Aesto, rent to store data and run applications instead of maintaining their own physical servers. Aesto stored the affected data within its AWS, as part of the archiving and migration services it performs for healthcare clients. Edwards County Medical Center is one of more than two dozen healthcare provider clients reportedly affected by the Aesto incident, a group that includes hospitals, clinics, and health systems in Kansas, Texas, Washington, South Carolina, Oregon, and Vermont. Attorneys are now investigating whether Edwards County Medical Center and Aesto took reasonable steps to prevent the unauthorized access, and whether the roughly eight-month gap between the intrusion and patient notification complied with applicable breach notification laws.

 

What was said

In a letter sent on Aesto's behalf, law firm McDonald Hopkins LLC stated that Aesto "has no evidence that any of the information has been misused."

 

By the numbers

  • Aesto's affected clients span at least six states: Kansas, Texas, Washington, South Carolina, Oregon, and Vermont.
  • More than two dozen healthcare provider clients were reportedly affected industry-wide.
  • Edwards County Medical Center's own impacted patient count is not specified, though the source material suggests it may be a small number relative to larger affected providers.
  • Roughly eight months passed between the start of the intrusion (December 2, 2025) and patient notification letters (August 26, 2026).
  • According to Paubox’s Healthcare's email security certificate crisis report, 16% of email-related healthcare breaches this year have involved business associates, the same category of vendor relationship at the center of the Aesto incident.

 

In the know

Edwards County Medical Center is what HIPAA classifies as a covered entity, which directly provides patient care and holds primary responsibility for protecting patient records. Aesto functions as a business associate, an outside vendor that handles protected health information on a covered entity's behalf. Under HIPAA, a covered entity cannot transfer away its accountability simply by outsourcing data storage or migration to a business associate. The covered entity remains responsible for confirming that any vendor it works with maintains adequate security safeguards for the sensitive information it holds.

Learn more: How to know if you’re a business associate

 

Why it matters

This incident shows how a vendor breach can disrupt dozens of healthcare organizations at once. Since Aesto provides archiving and migration services to more than two dozen providers across six states, one compromised AWS environment turned into a multi-state, multi-provider exposure event rather than an isolated incident at one hospital. It also shows how breach timelines can stretch out when a vendor serves many clients, Aesto needed several months to complete a forensic review covering multiple client organizations, and patients did not learn their information was compromised until roughly eight months after the intrusion began.

 

The bottom line

Edwards County Medical Center's experience shows that outsourcing data management does not eliminate a covered entity's duty to protect patient information. Healthcare organizations that hand records to a business associate remain liable when that vendor's security controls fail, and a single vendor's weak infrastructure can expose patients across dozens of unrelated institutions at once.

 

FAQs

What is a HIPAA business associate?

A business associate is any outside vendor or contractor that creates, receives, maintains, or transmits protected health information on behalf of a healthcare provider or other covered entity.

 

How long does a company have to notify patients after a data breach?

Under HIPAA, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach, though timelines can shift when a business associate is involved or when law enforcement requests a delay.

 

How can healthcare providers reduce the risk of vendor-related breaches?

Providers can lower their risk when they vet vendors' security practices before signing contracts, requiring prompt breach notification clauses, and periodically auditing how business associates handle sensitive data.