Centura Health (Colorado Healthcare Provider) reported to HHS OCR on 2014-04-22 a Hacking/IT Incident affecting 12,286 individuals. Employees inadvertently responded to a phishing email by clicking a fraudulent link and surrendering their usernames and passwords, enabling attacker access to those email accounts. Breached ePHI included demographic (names, addresses, DOB, phone numbers, SSNs), clinical (diagnoses, lab results, medications), and financial (claims) information. The CE notified HHS, affected individuals, media, and the FBI, and offered free credit monitoring. Corrective actions included updated risk management, employee retraining, and enhanced phishing-awareness education. OCR confirmed corrective action implementation.
Affected (this filing): 12,286