Verity Health System of California, Inc.

Verity Health System of California, Inc. reported to HHS on 2019-05-03 a Hacking/IT Incident affecting 662 individuals. Breached information located on Email. An unauthorized party accessed a workforce member’s email account containing PHI including demographic, clinical, and health plan information.

On January 26, 2019, Verity Health System of California, Inc. reported a hacking incident to HHS affecting 2,988 individuals. An unauthorized third party gained access to an employee's email account containing protected health information, including demographic, clinical, and financial data. The information was located on an email server. In response, the company implemented multi-factor authentication, enhanced password policies, and provided additional workforce training on identifying phishing attempts.

Verity Health System notified individuals that a third party compromised an employee's Microsoft 365 email account on November 27, 2018. The attacker sent emails with malicious links to obtain credentials. Health information, including SSNs and medical records, may have been accessed from email attachments. VHS acted as a business associate for O'Connor Hospital. The incident was contained, and credit monitoring was offered.

Verity Health System experienced a targeted email phishing scam on April 27, 2016, where an external actor impersonated an executive to request employee information. The incident was discovered on May 22, 2016. Affected data included names, addresses, Social Security numbers, and W-2 earnings/withholding information for current and former employees. No patient information or systems were breached. The company notified law enforcement, engaged outside experts, and offered two years of identity protection services to affected employees.