Summa Health data breach (2019)

Breach window
Mar 11, 2019 → Mar 29, 2019
When the intrusion reportedly occurred, per the linked filings
51 days
Breach discoveredAG web form
May 1, 2019
Reported by OREGON AG filing
58 days
OHHHS OCRFirst filing
Filed Jun 28, 2019bd_664dcc1105a64d17
Summa Health (OH) reported to HHS on 2019-06-28 a Hacking/IT Incident (email phishing) affecting 7,989 individuals. Several employees were victims of an email phishing scheme. PHI exposed included names, dates of birth, Social Security numbers, health insurance information, email addresses, diagnoses/conditions, medications prescribed, and treatment information. The CE notified affected individuals, media, and provided substitute notice. OCR obtained assurances of corrective action. Breached information located on Email.
Affected (this filing): 7,989
OHHHS OCRlinked via same-victim cross-source · 100%
Filed Jun 28, 2019bd_a5909b833f9eeea1
Summa Health reported to HHS on 2019-06-28 a Hacking/IT Incident affecting 2904 individuals. Breached information located on Email. Employees were victims of an email phishing scheme exposing PHI including names, MRNs, DOB, SSN, driver's license, and financial data. The CE implemented safeguards and retrained staff.
Affected (this filing): 2,904
HHS notified
🦫Oregon State AGMost recentlinked via same-victim cross-source · 100%
Filed Jun 28, 2019bd_a8f1004062396058
Summa Health reported a data breach to the Oregon Attorney General. The breach was reported on 2019-06-28. The breach occurred during 3/11/2019 - 3/29/2019. The breach was discovered on 5/1/2019. 7,989 individuals were affected. Notice was sent on 6/28/2019.
Affected (this filing): 7,989

SUMMA HEALTH

Litigation Timing

Sensitive data

Timeline