Cook County Health

Cook County Health and Hospitals System (IL) reported to HHS OCR on 2023-09-24 that its business associate experienced a ransomware attack affecting 1,248,546 individuals. PHI on network servers was compromised, including names, addresses, dates of birth, Social Security numbers, diagnoses, and other treatment information. The CE notified HHS, affected individuals, and the media, and terminated its business relationship with the responsible BA.

Cook County Health (IL) reported to HHS on 2021-07-02 an Unauthorized Access/Disclosure affecting 898 individuals. A subcontractor of the CE's business associate permitted unregistered drivers to provide medical transportation, exposing PHI including names, phone numbers, home addresses, and mobility status. Breached information located on Paper/Films.

Cook County Health reported to HHS on 2020-01-24 a Unauthorized Access/Disclosure affecting 2713 individuals. Breached information located on Network Server. PHI, including names, addresses, and email addresses, was impermissibly sent to a mailing vendor.

COOK COUNTY HEALTH filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-481). The register records the breach as discovered on November 26, 2019. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

COOK COUNTY HEALTH filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-143). The register records the breach as discovered on September 23, 2018. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Cook County Health & Hospitals System reported to HHS on 2017-10-27 a Unauthorized Access/Disclosure affecting 727 individuals. Breached information located on Network Server. Business associate Experian Health discovered an error in billing platform upgrade resulting in PHI delivery to wrong recipients.

Cook County Health and Hospitals System reported to HHS on 2014-09-15 a Hacking/IT Incident affecting 767 individuals. Breached information located on Email.

Cook County Health & Hospitals System (IL) reported to HHS on 2014-01-11 a breach of type 'Other' affecting 22,511 individuals. On November 12, 2013, a physician sent an unencrypted email with an Excel attachment containing PHI to a collaborator outside the organization's firewall, as part of a public health project with an academic medical center. PHI included demographic information and lab results. The attachment was unencrypted in violation of organizational policy. The CE disciplined the employee, implemented a new email security program, and retrained staff. OCR verified corrective actions.

Cook County Health & Hospitals System (IL) reported to HHS OCR on 2010-12-17 a Theft incident affecting 556 individuals. Breached information was located on a Desktop Computer. No business associate was involved. No further detail was provided in the web description.

Cook County Health & Hospitals System reported to HHS on 2010-08-20 a Theft affecting 7081 individuals. Breached information located on Laptop. An employee's laptop was stolen from a locked office; it contained PHI (names, DOB, SSN) of approximately 7,000 individuals. The entity notified affected individuals, posted notices, and retrained staff.