HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 4, 2016.
- Organization as reported
- Apria Healthcare, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Oct. 4, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14402, row:5541)
- Archived copy
- Held in the private archive (provenance)
Due to a phishing scam a workforce member provided unauthorized access to her work email account. On August 5, 2016, the covered entity (CE), Apria Healthcare, reported that approximately 1,987 individuals were potentially affected. The protected health information (PHI) involved included patients’ names, social security numbers, dates of birth, drivers’ license numbers, medical record numbers, diagnoses, and other clinical information. The CE provided breach notification to affected individuals, HHS, and the media. The CE also provided free credit monitoring services to the affected individuals. The CE revised its policies and procedures and provided training on phishing scams to all workforce members. OCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.