Apria Healthcare LLC

Apria Healthcare (CA, healthcare provider) reported to HHS OCR on 2016-10-04 that a workforce member fell for a phishing scam, granting unauthorized access to her work email account. Approximately 1,987 individuals were potentially affected. PHI involved included names, Social Security numbers, dates of birth, driver's license numbers, medical record numbers, diagnoses, and other clinical information. The CE notified affected individuals, HHS, and the media; provided free credit monitoring; revised policies and procedures; and trained workforce on phishing. OCR provided technical assistance and obtained assurances of corrective actions.

Affected (this filing):

Apria Healthcare, Inc. filed a security breach notification with the New Hampshire Attorney General on October 20, 2016. The filing concerns unauthorized access to computerized systems containing personal information and protected health information (PHI) of New Hampshire residents. The specific details regarding the number of affected individuals, the date of discovery, and the method of unauthorized access are not provided in the available document text.

On August 5, 2016, Apria Healthcare discovered unauthorized access to an employee's email account. The incident potentially exposed personal and medical information, including names, dates of birth, Social Security numbers, and diagnosis information, for 912 California residents. Apria Healthcare engaged forensic experts, changed credentials, and offered 12 months of credit monitoring. No evidence of data exfiltration was found.

Affected (this filing): 912