HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 9, 2015.
- Organization as reported
- Aspire Home Care and Hospice, OK
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 9, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14694, row:5833)
- Archived copy
- Held in the private archive (provenance)
On October 9 and 22, 2015, Aspire Home Care and Hospice, the covered entity (CE), experienced two similar breach incidents. The breach incidents involved phishing scams on the Google email accounts of two CE employees. The type of protected health information (PHI) involved in the breaches included demographic information, social security numbers, and treatment information. One breach report estimated that 4,278 individuals were affected, and in the second the estimate was 4,500 individuals. Later that number was amended since the CE determined that 1,889 persons had already been accounted for in the initial breach report. In response to the breach incidents, the CE took certain corrective action, including, but not limited to, implementing additional technical safeguards to prevent future security incidents of this nature. As a result of extensive technical assistance provided by OCR, the CE took corrective action, launching a phishing campaign to better train and educate workforce members regarding potential phishing incidents, and implementing additional Privacy and Security policies and procedures to ensure full compliance with the Privacy and Security Rules. Further, the CE conducted an updated risk analysis and implemented a corresponding risk management plan. The CE also offered affected individuals identity theft monitoring services for one year at no cost.