Community Memorial Health System

On June 22, 2017, Community Memorial Health System (CA) experienced a phishing incident in which several hundred staff members received phishing emails. One employee working remotely followed the link, compromising her account credentials. The breach affected 959 individuals. Breached information was located in Email systems. The CE notified HHS, affected individuals, and media, disabled remote/mobile access, required credential resets, enforced two-factor authentication, and deployed centralized server log monitoring. OCR obtained corrective action assurances.

On June 22, 2017, a Community Memorial Health System (CMHS) employee's email account was compromised via a phishing email. The employee detected anomalies on June 23, 2017, prompting a password reset and investigation. CMHS's forensic consultant found indicators suggesting no personal information was accessed, though certainty could not be confirmed. Affected data potentially included patient names, medical record/account numbers, dates of service, health information, and for some patients, SSNs. CMHS offered 24-month identity theft and credit monitoring via AllClear ID.