San Francisco Department of Public Health
Disclosed May 11, 20188 years ago900 affectedConfirmed
On November 14, 2018, the covered entity (CE), San Francisco Department of Public Health, filed a breach notification report after discovering a computer error that caused its business associate (BA), Alluma, to mislabel letters and send them to the wrong people. This incident affected the protected health information (PHI) of 622 individuals and included paper records and films that contained demographic information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE investigated the incident and implemented new technical safeguards. OCR obtained copies of the CE’s policies and procedures, documentation of administrative safeguards, and its BA agreement. As a result of OCR’s investigation, the CE added a step to its quality control process for renewal notices.
What is known
| People affected | 900 (as reported to HHS) |
|---|---|
| Disclosed | May 11, 2018 |
| Happened | Nov 14, 2018 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: San Francisco Department of Public Healthoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): San Francisco Department of Public Health (Healthcare Provider, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 11, 2018 | |
| HHS archivetotal | Jun 25, 2018 | 900 |
| California AGresidents of CA | Oct 3, 2019 | |
| HHS archivetotal | Oct 3, 2019 | 622 |
History of this record
- 2026-09-25 · records: 622 to 900 · backfill source
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 622 · backfill source
- 2026-09-25 · summary: empty to On November 14, 2018, the covered entity (CE), San Francisco Department of Public Health, filed a breach notification report after discovering a computer error that caused its business associate (BA), Alluma, to mislabel letters and send th · backfill source
- 2026-09-25 · disclosed: 2019-10-03 to 2018-05-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.