Palomar Health

Palomar Health notified patients of a data breach involving its vendor, PharMerica. An unknown third party accessed PharMerica's systems on March 12-13, 2023. Affected data included names, addresses, dates of birth, Social Security numbers, medications, and health insurance information for patients who received services at Palomar Continuing Care Center or The Villas at Poway between 2001 and 2020. Palomar Health learned of the incident on May 31, 2023, and conducted its own investigation. PharMerica is offering one year of credit and identity theft monitoring.

Palomar Health (Palomar Medical Center (Escondido)) reported to HHS on 2018-01-08 a Unauthorized Access/Disclosure affecting 1309 individuals. Breached information located on Electronic Medical Record. An ER nurse accessed patient records without a work-related reason.

On September 27, 2017, an employee of Palomar Health unintentionally misdirected an email containing patient-related information to an unintended recipient. The information included patient names, hospital-assigned ID numbers, admission/discharge dates, site of care, and primary payer/health plan names. It did not include SSNs, payment info, or medical records. The recipient deleted the email. Palomar Health notified the California Department of Public Health.

Palomar Health reported the theft of two flash drives from an employee's vehicle on February 22, 2014. The devices may have contained patient names, dates of birth, diagnoses, treatment information, and insurance information. Social Security numbers and financial information were not present. Palomar Health engaged forensic experts and reinforced staff security training.

Palomar Health (CA) reported to HHS on 2014-03-28 a Theft affecting 5,499 individuals. A workforce member's car was broken into, resulting in the theft of two unencrypted flash drives containing PHI, including names, dates of birth, diagnoses/treatment information, insurance information, and some Medicare numbers. The CE notified HHS, affected individuals, and media; provided credit monitoring; sanctioned and retrained the involved workforce member; and implemented a USB encryption lockdown project. OCR's investigation resulted in improved HIPAA practices.