Cottage Health System

Cottage Health, operating several hospitals in California, agreed to pay $3 million to settle potential HIPAA violations. The settlement includes a corrective action plan.

Cottage Health reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2015-12-07. 6 Massachusetts residents were affected. The report records the breach type as electronic.

Cottage Health disclosed that PHI of approximately 11,000 patients was inadvertently exposed to the internet between October 26 and November 8, 2015. The exposure included names, addresses, SSNs, insurance info, and limited medical data. The server was taken offline on November 8, 2015, and patients were offered 12 months of credit monitoring and identity theft protection.

Cottage Health reported to HHS on 2015-12-01 a Unauthorized Access/Disclosure affecting 11000 individuals. Breached information located on Network Server. The breach involved misconfigured server settings exposing ePHI including patient names, addresses, DOBs, SSNs, and medical records. Cottage Health settled with OCR for $3 million.

Cottage Health disclosed that PHI for approximately 11,000 patients was inadvertently exposed to the internet due to a server misconfiguration between October 26 and November 8, 2015. The exposed data included names, addresses, SSNs, insurance info, and limited medical records. The server was taken offline upon discovery on November 8, 2015. Identity theft protection services were offered to affected individuals.

Cottage Health System disclosed that a third-party vendor removed electronic security protections from a server, exposing patient health information including diagnoses and lab results. The incident was discovered on December 2, 2013, when the organization received a voicemail indicating the data was accessible via Google. The server was immediately taken offline, and the organization offered identity theft protection services to affected individuals.