CARDINAL HEALTH, INC.

mscripts, LLC, a health sector entity reported a theft or mistake incident to the Washington Attorney General. The organization became aware of the incident on 2022-11-18 and filed notice on 2023-03-14. 1,394 Washington residents were affected. 116 days elapsed between awareness and notification. 2240 days to identify the breach. 0 days to contain the breach.

mscripts reported a data breach to the Montana Attorney General. The breach was reported on 2023-03-14. The breach occurred from 9/30/2016 to 11/18/2022. 179 Montana residents were affected.

mscripts, LLC disclosed a misconfiguration of its cloud storage that left prescription management files accessible without authentication from September 30, 2016, to November 18, 2022. The exposed data included patient names, addresses, dates of birth, phone numbers, and prescription details (medication names, refill status). No SSNs or financial data were involved. mscripts engaged forensic investigators and changed access settings upon discovery.

mscripts, LLC reported a data breach to the Oregon Attorney General. The breach was reported on 2023-03-14. The breach occurred during 9/30/2016 - 11/18/2022. The breach was discovered on 1/13/2023. 5,725 individuals were affected. Notice was sent on 3/14/2023.

RGH Enterprises, Inc. d/b/a Edgepark Medical Supplies (OH) reported to HHS on 2019-07-05 a Hacking/IT Incident affecting 6,572 individuals. Breached ePHI was located on a Network Server and included names, dates of birth, addresses, health insurance information, and purchasing data. The CE implemented additional technical safeguards as mitigation and notified affected individuals, media, and posted a substitute notice on its website.

RGH Enterprises, Inc. reported to HHS on January 22, 2018, that a spreadsheet formatting error led to mailings being sent to the wrong patients. This unauthorized disclosure of protected health information (PHI), including patient names, affected 4,586 individuals. The company has since implemented new quality assurance procedures, retrained the responsible employee, and notified those affected.

Computer hackers installed malware on the covered entity's website that intercepted ePHI of approximately 4,230 individuals, including names, DOBs, contact details, partial payment-card data, primary physicians, diagnoses, order histories, and health insurer information. The entity removed the malware from affected servers and migrated the website to non-compromised infrastructure. Reported to HHS OCR on 2014-01-13.