The covered entity (CE), American Anesthesiology, reported that multiple employees of its business associate (BA) experienced an email phishing attack affecting the protected health information (PHI) of 1,269,074 individuals. The PHI involved included names, dates of birth, Social Security and drivers’ license numbers, diagnoses, lab results, medications prescribed, and financial and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented additional administrative and technical safeguards to better protected PHI. All staff were retrained on email security.
2026-09-25 · sector: other to health · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: organization to hhs · backfill source
2026-09-25 · records: 1159841 to 1269074 · backfill source
2026-09-25 · summary: empty to The covered entity (CE), American Anesthesiology, reported that multiple employees of its business associate (BA) experienced an email phishing attack affecting the protected health information (PHI) of 1,269,074 individuals. The PHI involv · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 1159841 · backfill source
2026-09-25 · discovered: empty to 2020-07-16 · backfill source
