Avalon Health Care Management
Disclosed Feb 14, 20206 years ago13,428 affectedConfirmed
The business associate (BA), Avalon Health Care Management, Inc., reported that an employee was the victim of an email phishing attack that compromised the protected health information (PHI) of 2,717 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, drivers’ license numbers, diagnoses, medications prescribed, and other treatment information. In response to the breach, the BA implemented additional technical safeguards, provided workforce members with HIPAA Privacy and Security Rule training, and developed additional policies and procedures. OCR provided technical assistance to the BA regarding the HIPAA Rules.
What is known
| People affected | 13,428 (as reported by the organization) |
|---|---|
| Disclosed | Feb 14, 2020 |
| Discovered | Jul 9, 2019 |
| Happened | Jun 17, 2019 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: Avalon Health Care Managementatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Avalon Health Care Managementjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2020 data breach report: Avalon Health Care Managementin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Avalon Health Care Managementmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Avalon Health Care Management (Business Associate, UT)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Feb 14, 2020 | 2,717 |
| Washington AGresidents of WA | Mar 16, 2020 | 1,861 |
| Oregon DOJresidents of OR | Mar 16, 2020 | 13,428 |
| Indiana AGresidents of IN | Mar 16, 2020 | 9 |
| Maine AGresidents of ME | Mar 16, 2020 | 2 |
History of this record
- 2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","health"] · backfill source
- 2026-09-25 · disclosed: 2020-03-16 to 2020-02-14 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Avalon Health Care Management, Inc., reported that an employee was the victim of an email phishing attack that compromised the protected health information (PHI) of 2,717 individuals. The PHI involved included n · backfill source
- 2026-09-25 · data_types: [] to ["names","ssn"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 13428 · backfill source
- 2026-09-25 · occurred: empty to 2019-06-17 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.