HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 24, 2015.
- Organization as reported
- Children's National Medical Center, DC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Feb. 24, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14877, row:6016)
- Archived copy
- Held in the private archive (provenance)
Employees of the covered entity (CE), Children’s National Medical Center (CNMS), responded to phishing emails they believed were legitimate emails. Over 20,000 individuals were affected by the breach which involved demographic, clinical and health insurance information, including a limited number of social security numbers. The CE provided breach notification to HHS, affected individuals, and the media, and offered 12 months of free identity monitoring for those whose social security number was compromised. Following the breach, the CE identified source attacks, remediated accounts, removed exfiltration software, and implemented safeguards to increase firewall protections and inspection of e-mails (monitoring, scanning, and rewriting of embedded Internet addresses). In addition, the CE updated its security policy and retrained employees. OCR obtained assurances that the CE has implemented the corrective actions listed above.