Community Health Systems Professional Services Corporation

Community Health Systems Professional Services Corporation (CHSPSC) reported a cyber attack occurring between April 10 and June 24, 2014. An Advanced Persistent Threat (APT) group from China bypassed security measures and exfiltrated patient data, including names, addresses, birthdates, and Social Security numbers. The incident was discovered in July 2014. CHSPSC engaged federal law enforcement and forensic experts, contained the breach, and offered one year of free identity theft protection to affected individuals.

Community Health Systems Professional Services Corporation (TN) reported to HHS OCR on 2014-08-20 a Theft incident affecting 4,500,000 individuals. The breached information was located on a Network Server. A business associate was present. No further detail is available from the HHS web description.

Affected (this filing): 4,500,000

Community Health Systems Professional Services Corporations reported to HHS a hacking incident affecting 6,121,158 individuals, first disclosed on August 21, 2014. The incident, which concluded in August 2014, involved a cyber-hacking group using compromised administrative credentials to access and exfiltrate protected health information from a network server. An OCR investigation revealed systemic noncompliance with HIPAA security rules, leading to a $2.3 million settlement and a corrective action plan.

Affected (this filing):