County of Los Angeles

On May 13, 2016, the County of Los Angeles experienced a phishing email attack affecting approximately 108 employee email accounts. The attack potentially compromised personally identifiable information (PII) and protected health information (PHI) of service recipients, including names, SSNs, driver's license numbers, payment card info, bank account info, and medical records. The County notified law enforcement and relevant regulators (CDPH, CA AG, HHS OCR). Free identity monitoring was offered to affected individuals.

County of Los Angeles reported to HHS on 2015-04-29 a Theft affecting 880 individuals. On April 3, 2015, during execution of a search warrant at the home of a DHS LAC+USC / Hawkins Mental Health Center employee, law enforcement discovered and seized items containing PHI of ~880 Hawkins patients treated 2011–2015. PHI included financial, demographic, and clinical information on Paper/Films. The employee was sanctioned, access terminated, and the employee resigned. HIPAA training was provided to Hawkins staff. OCR obtained assurances of corrective action.

LAC+USC Medical Center/Augustus F. Hawkins Mental Health Center notified patients that confidential medical records for approximately 900 individuals were seized by law enforcement from an employee's home during a search warrant execution on April 3, 2015. The records, dating from 2011-2015, contained names, SSNs, diagnoses, and insurance info. The incident is classified as physical theft/loss of data. The organization offered one year of identity theft protection and is reviewing security practices.

County of Los Angeles (CA) reported to HHS OCR on 2011-03-30 a Theft breach affecting 667 individuals. Breached information was located on a Laptop. No business associate was involved. No further description was provided in the HHS portal.

County of Los Angeles reported to HHS on 2010-09-17 a Theft affecting 33000 individuals. Breached information located on Paper/Films.