HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 21, 2017.
- Organization as reported
- Baptist Health Louisville, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Nov. 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13996, row:5135)
- Archived copy
- Held in the private archive (provenance)
Baptist Health Louisville, the covered entity (CE), reported that two of its employees had been victims of a phishing incident on two separate days, exposing the protected health information (PHI), including names, dates of birth, addresses, social security numbers, and clinical information, of 880 individuals. The CE provided timely breach notification to HHS, affected individuals and the media. At the time of the breach and subsequently, the CE trained its employees on its HIPAA policies and procedures including the reporting of suspicious emails. In response to the breach, the CE specifically retrained the employees involved in the phishing incidents on identifying and reporting potential phishing emails. OCR reviewed the CE's HIPAA policies and procedures during the investigation and obtained assurances that the CE implemented the corrective actions listed above.