American Medical Response
Disclosed Nov 9, 20187 years ago23,356 affectedConfirmed
Pursuant to breach notification requirements, OCR received a breach report from American Medical Response, Inc. (AMR), the covered entity. Since this report was a duplicate of a previous breach notification to OCR, it was combined and the two transactions were resolved together. AMR reported that an unauthorized third party gained access to its employee email accounts maintained and administered by its business associate (BA). The email accounts contained the protected health information (PHI) of 4,300 individuals. The PHI involved included names, addresses, dates of birth, age, drivers’ license numbers, medical record numbers, account numbers, and Social Security numbers. As a result of this incident, AMR ended its business relationship with its business associate. The CE provided breach notification to the affected individuals and the media. AMR implemented additional security controls and re-trained its workforce to mitigate future email phishing attacks.
What is known
| People affected | 23,356 (as reported by the organization) |
|---|---|
| Disclosed | Nov 9, 2018 |
| Discovered | May 9, 2019 |
| Happened | Sep 24, 2018 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Government IDs, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: American Medical Responseoag.ca.gov · Official notice | Official notice |
| Oregon DOJ breach notice: American Medical Responsejustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2019 data breach report: American Medical Responsein.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: American Medical Responsemaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): American Medical Response (Healthcare Provider, TX)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Nov 9, 2018 | 912 |
| HHS archivetotal | May 6, 2019 | 4,300 |
| Indiana AGresidents of IN | Jun 7, 2019 | 317 |
| Maine AGresidents of ME | Jun 7, 2019 | 18 |
| California AGresidents of CA | Jun 11, 2019 | |
| Oregon DOJresidents of OR | Jun 11, 2019 | 23,356 |
History of this record
- 2026-09-25 · disclosed: 2019-05-06 to 2018-11-09 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: ["names","ssn","government-id"] to ["names","ssn","government-id","health"] · backfill source
- 2026-09-25 · disclosed: 2019-06-07 to 2019-05-06 · backfill source
- 2026-09-25 · summary: empty to Pursuant to breach notification requirements, OCR received a breach report from American Medical Response, Inc. (AMR), the covered entity. Since this report was a duplicate of a previous breach notification to OCR, it was combined and the t · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn","government-id"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 23356 · backfill source
- 2026-09-25 · disclosed: 2019-06-11 to 2019-06-07 · backfill source
- 2026-09-25 · discovered: empty to 2019-05-09 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.