An unauthorized third party accessed a workforce member’s email account, affecting the protected health information (PHI) of 14,894 individuals, including demographic, clinical, health plan claims, and payment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE strengthened safeguards by adding technical measures to protect against phishing and malicious email and trained workforce members to identify phishing attempts. OCR obtained evidence of the safeguards that the CE implemented prior to the breach and documented assurances that the CE implemented the voluntary corrective action steps noted above.
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: empty to hhs · backfill source
2026-09-25 · records: empty to 14894 · backfill source
2026-09-25 · summary: empty to An unauthorized third party accessed a workforce member’s email account, affecting the protected health information (PHI) of 14,894 individuals, including demographic, clinical, health plan claims, and payment information. The CE provided b · backfill source
2026-09-25 · disclosed: 2019-03-22 to 2019-01-28 · backfill source
