REVA

Disclosed Jan 22, 20201,000 affectedConfirmed

REVA, the covered entity (CE), reported that numerous employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 783 individuals. The ePHI involved included names, birthdates, Social Security numbers, financial information, health insurance information, and treatment information. The CE notified HHS, affected individuals, and posted substitute notice on its website. In response to the breach, the CE implemented additional administrative, technical, and security safeguards to better protect its sensitive data. OCR provided technical assistance to the CE on the HIPAA Security and Breach Notification Rule.

What is known

People affected	1,000 (as reported by the organization)
Disclosed	Jan 22, 2020
Discovered	Sep 12, 2019
Happened	Jul 23, 2019
Attack	Hacking
Data exposed	NamesGovernment IDsHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticemaine.gov

Maine Attorney General breach notice archive: REVA

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): REVA (Healthcare Provider, FL)

Notices filed

Residents of MEJan 22, 2020

Maine AG1 person

TotalJan 22, 2020

HHS archive1,000 people

History of this record

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

["names","government-id"] to ["names","government-id","health"]by backfillSource

summary2026-09-25

empty to REVA, the covered entity (CE), reported that numerous employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 783 individuals. The ePHI involved included names, birthdates, by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Maine AG), confirmed by Maine AG. Record counts are as reported. Not legal advice.

Everything about REVA