Three Rivers Provider Network
Disclosed Oct 15, 20223 years ago16,584 affectedConfirmed
The business associate (BA), Three Rivers Provider Network, reported that an employee was the subject of an email phishing scheme that compromised the protected health information (PHI) of 4,725 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, claims information, health insurance information, diagnoses, medications, and other treatment information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA implemented additional administrative and technical safeguards and retrained its staff.
What is known
| People affected | 16,584 (as reported by the organization) |
|---|---|
| Disclosed | Oct 15, 2022 |
| Happened | Jun 2, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Tech · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Three Rivers Provider Networkoag.ca.gov · Official notice | Official notice |
| Vermont Attorney General: 20222 10 31 Three Rivers Provider Network Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2022-10-15 Three Rivers Provider Network Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2022 data breach report: Three Rivers Provider Networkin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Three Rivers Provider Network (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Oct 15, 2022 | |
| Indiana AGresidents of IN | Oct 15, 2022 | 92 |
| Vermont AGresidents of VT | Oct 31, 2022 | |
| California AGresidents of CA | Nov 9, 2022 | |
| HHS archivetotal | Dec 19, 2022 | 4,725 |
| California AGresidents of CA | Jul 21, 2023 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Three Rivers Provider Network, reported that an employee was the subject of an email phishing scheme that compromised the protected health information (PHI) of 4,725 individuals. The PHI involved included names, · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 16584 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2022-10-15-three-rivers-provider-network-data-breach-notice-consumers · backfill source
- 2026-09-25 · disclosed: 2022-10-31 to 2022-10-15 · backfill source
- 2026-09-25 · disclosed: 2022-11-09 to 2022-10-31 · backfill source
- 2026-09-25 · disclosed: 2023-07-21 to 2022-11-09 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.