Alana Healthcare
Disclosed Apr 12, 20197 years ago2,691 affectedConfirmed
From December 26, 2018, to January 17, 2019, an unauthorized intruder accessed an employee’s email through a phishing incident, potentially gaining access to 2,691 individuals’ names, dates of birth, Social Security numbers, doctors’ notes, medication types, and facilities where the patients were seen. To mitigate the breach, the covered entity (CE), Alana Healthcare, deactivated the affected email account, implemented multi-factor authentication, changed email passwords, trained employees on phishing, and conducted a risk analysis. The CE provided breach notification to HHS, affected individuals, and the media in April 2019.
What is known
| People affected | 2,691 (as reported to HHS) |
|---|---|
| Disclosed | Apr 12, 2019 |
| Happened | Dec 26, 2018 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2019 data breach report: Alana Healthcarein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Alana Healthcare (Healthcare Provider, TN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Apr 12, 2019 | 2 |
| HHS archivetotal | Apr 18, 2019 | 2,691 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 2685 to 2691 · backfill source
- 2026-09-25 · summary: empty to From December 26, 2018, to January 17, 2019, an unauthorized intruder accessed an employee’s email through a phishing incident, potentially gaining access to 2,691 individuals’ names, dates of birth, Social Security numbers, doctors’ notes, · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.