Berkeley Endocrine Clinic data breach (2016)

Breach window

Apr 22, 2016

When the intrusion reportedly occurred, per the linked filings

Breach discoveredletter-grounded

Apr 22, 2016

Reported by CALIFORNIA AG filing

31 days

🐻California State AGFirst filinglinked via same-victim cross-source · 100%

Filed May 23, 2016bd_7afd3554941b3508

Berkeley Endocrine Clinic disclosed that on April 22, 2016, a notification email sent to patients regarding a spam incident inadvertently exposed the recipient list. The exposed data potentially included patients' first and last names and email addresses. No other information was involved. The clinic implemented additional internal administrative steps to prevent recurrence.

CA 60-day OK · 1d

CALIFORNIAHHS OCRMost recentlinked via same-victim cross-source · 100%

Filed May 24, 2016bd_ce5997b840eef1e2

Berkeley Endocrine Clinic reported to HHS OCR on 2016-05-24 an Unauthorized Access/Disclosure affecting 1,370 individuals. The clinic inadvertently sent an email notification to 1,370 patients without blind-copying recipients, exposing patients' first and last names and email addresses. Breached information was located in Email. Following the breach, the CE revised email procedures, enhanced technical measures (including desktop encryption), and retrained staff. OCR's investigation led to enhanced ePHI safeguarding practices.

Affected (this filing):

Berkeley Endocrine Clinic

Litigation Timing

Timeline