Breachesby GlyphMassachusetts General Hospital
Disclosed Aug 5, 2014648 affectedConfirmed
An employee of the covered entity (CE), Massachusetts General Hospital, sent an unencrypted e-mail to the incorrect e-mail address. The e-mail contained the protected health information (PHI of 648 individuals. The types of PHI involved in the breach included names, dates of birth, medical record number sand social security numbers. Following the breach, the CE sanctioned the employee in question and changed its policy to use a secure storage application instead of e-mail to send PHI. OCR obtained assurances that the CE implemented the corrective actions listed above.
What is known
| People affected | 648 (as reported to HHS) |
|---|---|
| Disclosed | Aug 5, 2014 |
| Attack | Insider |
| Data exposed | NamesHealth |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at Massachusetts General Hospital
Breach, details not statedBreach notice filed with the Vermont AG, details not stated.HealthcareUSFeb 21, 2024Hacking breachHacking exposed names and health records. Reported to the HHS archive.9,900 affectedHealthcareUSDec 14, 2018Breach, details not statedExposed names, Social Security numbers and names. Reported to the Maine AG.HealthcareUSMar 21, 2017Hacking breachHacking exposed names and health records. Reported to the HHS archive.4,293 affectedHealthcareUSJun 29, 2016
History of this record
unknown to insiderby backfillSource
empty to hhsby backfillSource
empty to 648by backfillSource
empty to An employee of the covered entity (CE), Massachusetts General Hospital, sent an unencrypted e-mail to the incorrect e-mail address. The e-mail contained the protected health information (PHI of 648 individuals. The types of PHI involved in by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (Maine AG), confirmed by Maine AG. Record counts are as reported. Not legal advice.