Santa Rosa Community Health Centers

Santa Rosa Community Health Centers (SRCH) disclosed a security incident involving unauthorized access to a corporate email account via suspicious email activity (phishing). The breach impacted Protected Health Information (PHI), including names, Social Security numbers, dates of birth, addresses, and health insurance/billing information. SRCH engaged forensic experts, reset passwords, implemented MFA, and offered IDX identity protection services to affected individuals.

Santa Rosa Community Health Centers (CA) reported to HHS on 2021-02-26 a Hacking/IT Incident (email phishing) affecting 5,983 individuals. An employee was the victim of a phishing scheme compromising ePHI stored in Email. Exposed data included names, addresses, dates of birth, Social Security numbers, diagnoses, health insurance and claims information, and other treatment information. The CE notified HHS, affected individuals, and the media, and subsequently implemented additional technical safeguards and retrained its workforce.

Affected (this filing): 5,983