Summit Behavioral Healthcare, Inc.

Summit Behavioral Healthcare reported to HHS on 2021-02-26 a Unauthorized Access/Disclosure affecting 70,822 individuals. Breached information located on Email. An employee impermissibly emailed ePHI to a personal account. The entity implemented additional administrative, technical, and security safeguards.

Summit Behavioral Healthcare (SBHC) experienced unauthorized access to two employee email accounts between approximately May 12–20, 2020. Suspicious activity was detected in late May 2020, but the investigation did not confirm that protected health information (PHI) was affected until January 21, 2021. A third-party forensics firm conducted the investigation. Affected individuals were notified in February 2021 and offered 12 months of free credit and identity monitoring through IDX.

Summit Behavioral Healthcare reported an unauthorized access to email systems occurring on May 12, 2020, discovered on January 21, 2021. The breach affected 70,822 individuals, exposing names and driver's license numbers. The company notified affected individuals in writing on February 26, 2021, and offered identity theft protection services. The incident was reported to the Maine Attorney General.

Inspira Behavioral Care, Corp reported to HHS on 2019-05-02 a Theft affecting 4246 individuals. Breached information located on Desktop Computer. The incident involved the theft of an unencrypted computer containing PHI (names, DOB, diagnoses, treatment info). The entity notified HHS, individuals, and media, encrypted computers, installed physical security, and re-trained staff.