Oakland Family Services

On July 14, 2015, the covered entity (CE), Oakland Family Services, discovered that an unauthorized individual remotely gained access to an employee’s email account containing the protected health information (PHI) of 16,107 individuals. The types of PHI potentially viewed included clinical and demographic information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE immediately terminated the hacker’s access to the email account, improved safeguards by implementing a new email solution that provides more protections for passwords, and trained employees on HIPAA and IT security. OCR obtained documented assurances that the CE implemented the voluntary corrective action steps listed above.