HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 8, 2017.
- Organization as reported
- Children's Hospital Colorado, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Sept. 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14064, row:5203)
- Archived copy
- Held in the private archive (provenance)
Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a $548,265 civil monetary penalty against Children’s Hospital Colorado, concerning violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules following receipt of breach reports in 2017 and 2020, relating to email phishing and cyberattacks . OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of protected health information (PHI). The HIPAA Security Rule establishes national standards to protect and secure our health care system by requiring administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic PHI (ePHI). “Email continues to be a very common way for cyberattackers to enter health information systems and jeopardized privacy and security,” said OCR Director Melanie Fontes Rainer. “Health care entities should identify potential risks and vulnerabilities to email accounts and train their workforce to protect health information in those accounts.” OCR investigated Children’s Hospital Colorado following breaches which reported a phishing attack that compromised an email account containing 3,370 individuals’ PHI and another after three email accounts were breached, containing 10,840 individuals’ PHI. OCR’s investigation determined that the first reported breach occurred because multi-factor authentication was disabled on an email account. The second breaches occurred, in part, when workforce members gave permission to unknown third parties to access their email accounts. OCR also found violations of the HIPAA Privacy Rule for failure to train workforce members on the HIPAA Privacy Rule, and the HIPAA Security Rule requirement to…