Clinical Pathology Diagnostics, LLC

Clinical Pathology Diagnostics, LLC (CT, healthcare provider) reported to HHS OCR on 2021-10-12 that employees of its business associate suffered an email phishing attack exposing PHI of approximately 2,500 individuals. PHI included names, addresses, dates of birth, SSNs, financial and health insurance information, and prescription/clinical data. The CE notified HHS, affected individuals, the media, and provided substitute notice.

Clinical Pathology Laboratories, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2019-07-16. The breach occurred during 3/21/2019. The breach was discovered on 5/15/2019. Notice was sent on 7/15/2019.

Clinical Pathology Laboratories, Inc. (CPL) notified California regulators of a data security incident involving its third-party vendor, Retrieval Masters Creditors Bureau (d/b/a American Medical Collection Agency or AMCA). On May 15, 2019, CPL was informed that AMCA experienced unauthorized access to a database containing patient information. The breach affected patient data including names, addresses, phone numbers, dates of birth, service dates, balances, and treatment provider information. CPL stopped using AMCA for collection efforts and engaged cybersecurity experts. No misuse of information was known at the time of notification.

Clinical Pathology Laboratories, Inc. reported to HHS on 2019-07-15 a Hacking/IT Incident affecting 1,733,836 individuals. The breach involved a business associate, Retrieval-Masters Creditors Bureau, Inc., which suffered a cyber-attack affecting ePHI located on a network server. The CE notified HHS, individuals, and media, provided credit monitoring, and terminated the BA relationship.

Clinical Pathology Laboratories, Inc., a health sector entity reported a malware incident to the Washington Attorney General. The organization became aware of the incident on 2019-05-15 and filed notice on 2019-07-15. 1,155 Washington residents were affected. 61 days elapsed between awareness and notification. 55 days to identify the breach.