EPIC MANAGEMENT
Disclosed Nov 14, 20223 years ago10,050 affectedConfirmed
The business associate (BA), EPIC Management, reported that an employee was the victim of an email phishing scheme that compromised the protected health information (PHI) of 1,190 individuals. The PHI involved included names, member identification numbers, and health insurance and financial information. The BA notified HHS, affected individuals, and the media. In response to the breach the BA implemented additional technical safeguards and retrained its workforce members to better protect its PHI. OCR provided technical assistance to the BA regarding the HIPAA Rules.
What is known
| People affected | 10,050 (as reported by the organization) |
|---|---|
| Disclosed | Nov 14, 2022 |
| Happened | Jan 24, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: EPIC MANAGEMENToag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 2022 12 14 Epic Management Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2022 data breach report: Epic Managementin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): EPIC Management (Health Plan, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Nov 14, 2022 | 10,050 |
| Vermont AGresidents of VT | Dec 14, 2022 | |
| Indiana AGresidents of IN | Dec 14, 2022 | 11 |
| California AGresidents of CA | Mar 8, 2023 | |
| HHS archivetotal | Mar 8, 2023 | 1,190 |
History of this record
- 2026-09-25 · disclosed: 2022-12-14 to 2022-11-14 · backfill source
- 2026-09-25 · sector: other to insurance · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), EPIC Management, reported that an employee was the victim of an email phishing scheme that compromised the protected health information (PHI) of 1,190 individuals. The PHI involved included names, member identif · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 10050 · backfill source
- 2026-09-25 · disclosed: 2023-03-08 to 2022-12-14 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.