On December 3, 2014, the covered entity (CE), St. Mary’s Health, discovered that a phishing email attack compromised several employees’ user names and passwords. The breach affected approximately 3,952 individuals. The types of protected health information (PHI) involved in the breach included patients’ names, addresses, date of birth, clinical information, and in some instances, social security numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE deployed a program to assist users in identifying phishing and malware attacks. OCR obtained documented assurances that the CE implemented the corrective actions listed above.
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: organization to hhs · backfill source
2026-09-25 · records: 69 to 3952 · backfill source
2026-09-25 · disclosed: 2015-11-16 to 2015-03-05 · backfill source
2026-09-25 · summary: empty to On December 3, 2014, the covered entity (CE), St. Mary’s Health, discovered that a phishing email attack compromised several employees’ user names and passwords. The breach affected approximately 3,952 individuals. The types of protected he · backfill source
2026-09-25 · disclosed: 2016-03-09 to 2015-11-16 · backfill source
