Three Rivers Provider Network

On June 3, 2022, Three Rivers Provider Network (TRPN) identified unauthorized access to one employee email account by an unauthorized party. The account was immediately secured. On August 17, 2022, TRPN determined that personal information of affected individuals may have been accessed. TRPN offered 24-month complimentary Equifax credit monitoring to affected individuals. No financial account or credit card data was involved.

Three Rivers Provider Network, a HIPAA business associate based in California, reported to HHS OCR that an employee fell victim to an email phishing scheme, compromising the PHI of 4,725 individuals. Compromised data included names, addresses, dates of birth, Social Security numbers, claims information, health insurance information, diagnoses, medications, and other treatment information. The BA notified HHS, affected individuals, and the media, implemented additional administrative and technical safeguards, and retrained staff.

Affected (this filing): 4,725