St. Luke's Health System

Disclosed Aug 2, 202231,573 affectedConfirmed

St. Luke’s Health System, the covered entity (CE), reported that an employee of its business associate (BA) inadvertently mailed the protected health information (PHI) of 15,246 individuals to the wrong recipient. The PHI involved included names, financial information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE and BA corrected and updated the printing system to prevent similar incident in the future.

What is known

People affected	31,573 (as reported to HHS)
Disclosed	Aug 2, 2022
Discovered	Jul 6, 2022
Happened	May 18, 2022
Attack	Insider
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticejustice.oregon.gov

Oregon DOJ breach notice: St. Luke's Health System

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): St. Luke's Health System (Healthcare Provider, ID)

Notices filed

Residents of ORAug 2, 2022

Oregon DOJ31,573 people

TotalAug 2, 2022

HHS archive31,573 people

TotalApr 6, 2023

HHS archive15,246 people

History of this record

records2026-09-25

15246 to 31573by backfillSource

attack2026-09-25

unknown to insiderby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 15246by backfillSource

summary2026-09-25

empty to St. Luke’s Health System, the covered entity (CE), reported that an employee of its business associate (BA) inadvertently mailed the protected health information (PHI) of 15,246 individuals to the wrong recipient. The PHI involved included by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.

Everything about St. Luke's Health System