HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 21, 2016.
- Organization as reported
- Baystate Health, Inc., MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 21, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14385, row:5524)
- Archived copy
- Held in the private archive (provenance)
On July 27, 2016, a phishing e-mail was sent to 155 employees of the covered entity (CE), Baystate Health, Inc. Five employees responded to the phishing e-mail, which allowed the hackers to gain access to their e-mail accounts, potentially affecting the protected health information (PHI) of 13,112 individuals. The types of PHI that was potentially exposed may have included patients’ names, demographic information, dates of birth, diagnoses, treatments, medical record numbers, and in some instances, health insurance identification numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE retrained employees, issued additional phishing reminders to all employees, and incorporated additional information about phishing into various trainings. Additionally, the CE improved technical safeguards. OCR reviewed the CE's HIPAA policies and procedures as related to this breach for compliance with the Privacy and Security Rule and obtained assurances that the CE implemented the corrective actions listed above.