HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 27, 2017.
- Organization as reported
- Christine D. Collins, APC & Ann Hofstadter, MD Inc., CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- July 27, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14113, row:5252)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Christine D. Collins, APC & Ann Hofstader, MD Inc., discovered that a third party may have gained unauthorized access to its computer systems when email access credentials belonging to an employee were wrongfully acquired as a result of a cyber-security attack on May 27, 2017. The CE’s investigation determined that the employee’s email account was subject to unauthorized access between May 27, 2017, and May 28, 2017. The breach involved the protected health information (PHI) of 1,500 individuals and included names, addresses, dates of birth, social security numbers, and medical information. In response to the breach incident the CE immediately disabled the account, reset the credentials for the impacted user account, implemented two-factor authentication for email access, and updated its policies and procedures. The CE provided breach notification to HHS, affected individuals, and the media. OCR provided technical assistance regarding the CE’s obligation to conduct a comprehensive and current security risk analysis, along with implementing a corresponding risk management/mitigation plan to address the findings of its risk analysis report.