City Health, a medical
Disclosed Apr 14, 20265 months ago65,000 affectedConfirmed
The covered entity (CE), City Health, reported that a former IT employee accessed the CE’s network three years after his termination without authorization and may have accessed the protected health information (PHI) of 65,000 individuals. The PHI involved included demographic and financial information. The CE notified HHS and the affected individuals. In response to the breach, the CE implemented additional administrative, technical, and security safeguards to better protect its PHI.
What is known
| People affected | 65,000 (as reported to HHS) |
|---|---|
| Disclosed | Apr 14, 2026 |
| Happened | Mar 2, 2026 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: City Health, a medicaloag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): City Health, a medical (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Apr 14 | |
| HHS archivetotal | Apr 14 | 65,000 |
History of this record
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 65000 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), City Health, reported that a former IT employee accessed the CE’s network three years after his termination without authorization and may have accessed the protected health information (PHI) of 65,000 individuals. T · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.