Sutter Medical Foundation

Sutter Medical Foundation (CA) reported to HHS OCR on 2015-09-11 an Unauthorized Access/Disclosure affecting 2,302 individuals. A former employee of Sutter Connect, LLC dba Sutter Physician Services (a business associate) retained copies of patient information and emailed electronic documents to a personal email account. PHI involved: names, dates of birth, financial information, claims information, clinical information, and diagnosis/conditions. Relatives of the former employee alerted Sutter Health, citing concern about identity theft and unlawful check writing. Breached information located in Email. Staff were retrained on PHI safeguarding.

Affected (this filing): 2,302

Sutter Medical Foundation experienced a cybersecurity incident on April 26, 2013, involving unauthorized access to its electronic health record system. The breach affected approximately 205,489 individuals, exposing government-issued IDs, financial account numbers, and personal information. The organization engaged forensic investigators, notified law enforcement, and provided credit monitoring services to affected parties.

Affected (this filing): 205,489