HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 12, 2018.
- Organization as reported
- Catawba Valley Medical Center, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 12, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13659, row:4798)
- Archived copy
- Held in the private archive (provenance)
In August 2018, the covered entity (CE), Catawba Valley Medical Center, discovered that an unauthorized person gained access to the email accounts of three employees via a phishing attack. The CE scanned all the emails potentially affected and determined that 22,952 individuals’ protected health information (PHI) may have been compromised, including demographic and health insurance information. Following the breach, the CE changed the passwords on the affected accounts and set up additional system activity monitoring. The CE implemented a multifactor authentication requirement, provided additional training to staff members related to phishing attacks, and activated a software plugin that assists in reporting suspicious emails to the CE’s service desk. The CE provided breach notification to HHS, affected individuals, and the media and posted notice on its website. OCR provided technical assistance to the CE related to the Security Rule and phishing attacks and obtained assurances that the CE implemented the corrective actions listed above.