HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 13, 2018.
- Organization as reported
- Charles Cole Memorial Hospital, PA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- July 13, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13755, row:4894)
- Archived copy
- Held in the private archive (provenance)
As the result of a phishing attack, on June 7, 2018, and June 14, 2018, unauthorized users accessed three email accounts containing the protected health information (PHI) of 790 individuals; however, there is no evidence that the emails containing the PHI were actually accessed. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the covered entity (CE) blocked the email sender, blocked the hyperlink in the web appliance, and sent a communication to the recipients of the phishing attack notifying them of the phishing email. The CE also required staff to reset passwords and trained staff regarding phishing emails. In addition, the CE implemented administrative and technical safeguards for emails by restricting bulk email, restricting the affected accounts from sending external emails, and deploying scripts to search and delete malicious emails from email exchange servers. OCR reviewed the CE’s individual breach notification and the security measures it implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.