California Correctional Health Care Services
Disclosed Mar 13, 20242 years ago4,105 affectedConfirmed
The covered entity (CE), California Correctional Health Care Services, reported that a workforce member sent an unencrypted email containing the protected health information (PHI) of 4,105 individuals to the wrong recipients. The PHI involved included names, diagnoses, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE retrained workforce members to better protect PHI.
What is known
| People affected | 4,105 (as reported to HHS) |
|---|---|
| Disclosed | Mar 13, 2024 |
| Happened | Aug 21, 2023 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: California Correctional Health Care Servicesoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): California Correctional Health Care Services (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Mar 13, 2024 | |
| HHS archivetotal | Mar 14, 2024 | 1,348 |
| California AGresidents of CA | Dec 23, 2024 | |
| California AGresidents of CA | Apr 9, 2025 | |
| HHS archivetotal | Apr 9, 2025 | 4,105 |
Other breaches at California Correctional Health Care Services
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Nov 18, 2022Nov 18, 20223 years ago | Nov 18, 20223 years ago | Not stated | Healthcare | Confirmed | Unknown |
| Disclosed Dec 2, 2021Dec 2, 20214 years ago | Dec 2, 20214 years ago | Not stated | Healthcare | Confirmed | Unknown |
| Stolen unencrypted laptop held custody and medical data of 400,000 inmatesMay 15, 201610 years agoLost or stolen device | May 15, 201610 years ago | Lost or stolen device | Government | Confirmed | 400K |
| Disclosed Jul 30, 2013Jul 30, 201313 years ago | Jul 30, 201313 years ago | Not stated | Healthcare | Confirmed | 1,033 |
| Disclosed Aug 7, 2012Aug 7, 201214 years ago | Aug 7, 201214 years ago | Not stated | Healthcare | Confirmed | Unknown |
History of this record
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 4105 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), California Correctional Health Care Services, reported that a workforce member sent an unencrypted email containing the protected health information (PHI) of 4,105 individuals to the wrong recipients. The PHI involv · backfill source
- 2026-09-25 · disclosed: 2024-12-23 to 2024-03-13 · backfill source
- 2026-09-25 · disclosed: 2025-04-09 to 2024-12-23 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.
Everything about California Correctional Health Care Services