HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 7, 2014.
- Organization as reported
- Central Utah Clinic, UT
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 7, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15024, row:6163)
- Archived copy
- Held in the private archive (provenance)
On June 9, 2014, Revere Health, the covered entity (CE), discovered that cybercriminals had compromised one of its Internet-facing servers containing electronic protected health information (ePHI), affecting 31,677 patients. The compromised ePHI which included images, written imaging notes, and radiology reports dating 2010 and earlier, which contained identifying patient information – names, and/or dates of birth, and/or social security numbers, and/or addresses, and/or telephone numbers. The CE provided breach notification to the affected individuals, the media, and HHS. Following the breach, the CE took several corrective actions, including but not limited to: updating its inventory of ePHI, servers, databases, users, and applications; reducing vulnerabilities and blocking the affected server from the Internet; conducting penetration tests; drafting new security policies; implementing new response procedures; updating patch management procedures; upgrading the functionality in its firewalls, antivirus, and antimalware software; expanding its security team; and providing security and awareness training to its workforce. In the course of its review, OCR provided the CE with technical assistance regarding necessary changes to its policies and procedures, and its security management process.