HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 22, 2014.
- Organization as reported
- Centura Health, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 22, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15105, row:6244)
- Archived copy
- Held in the private archive (provenance)
OCR initiated an investigation after the covered entity (CE), Centura Health, reported that it experienced a phishing attack. Because a few of its employees inadvertently responded to the fraudulent email by clicking on a link and providing their usernames and passwords, these employees’ email accounts may have been accessible to the attacker(s). The CE detected and contained the incident because less than 5% of its employees received the phishing email. The compromised email accounts resulted in a breach of 12,286 individuals’ electronic protected health information (ePHI) in the form of demographic (names, addresses, dates of birth, telephone numbers, social security numbers, other identifiers), clinical (diagnoses, lab results, medications, other treatment) and/or financial (claims) information. The CE provided breach notification to HHS, affected individuals, and the media. The CE also notified the Federal Bureau of Investigation and offered free credit monitoring services to the individuals who had their social security number or financial information potentially compromised. Following the breach, the CE updated its risk management plan which included escalating in priority its implementation of certain previously identified security measures; retrained all its employees, and enhanced its annual compliance education training to provide additional content regarding phishing scams. OCR obtained assurance that the CE implemented the corrective actions noted above.