St. Luke's Health System
Disclosed Aug 2, 20224 years ago31,573 affectedConfirmed
St. Luke’s Health System, the covered entity (CE), reported that an employee of its business associate (BA) inadvertently mailed the protected health information (PHI) of 15,246 individuals to the wrong recipient. The PHI involved included names, financial information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE and BA corrected and updated the printing system to prevent similar incident in the future.
What is known
| People affected | 31,573 (as reported to HHS) |
|---|---|
| Disclosed | Aug 2, 2022 |
| Discovered | Jul 6, 2022 |
| Happened | May 18, 2022 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Oregon DOJ breach notice: St. Luke's Health Systemjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): St. Luke's Health System (Healthcare Provider, ID)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Oregon DOJresidents of OR | Aug 2, 2022 | 31,573 |
| HHS archivetotal | Aug 2, 2022 | 31,573 |
| HHS archivetotal | Apr 6, 2023 | 15,246 |
History of this record
- 2026-09-25 · records: 15246 to 31573 · backfill source
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 15246 · backfill source
- 2026-09-25 · summary: empty to St. Luke’s Health System, the covered entity (CE), reported that an employee of its business associate (BA) inadvertently mailed the protected health information (PHI) of 15,246 individuals to the wrong recipient. The PHI involved included · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.