HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 4, 2016.
- Organization as reported
- City of Hope, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- March 4, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14599, row:5738)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), City of Hope, received a phishing email on January 18, 2016, causing unauthorized access to several employee email accounts. The protected health information (PHI) involved in the breach included patients' names, medical record numbers, dates of birth, addresses, email addresses, telephone numbers, clinical information, test results, and dates of service and for one patient, the social security number and financial information. Approximately 1,024 individuals were affected by the breach. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice. Following the breach, the CE blocked access to a form in the embedded link contained in the phishing email, blocked the sender of the phishing email from sending additional emails, updated its spam filter, removed the email from the inboxes of users who received it, and sent an email to all staff to advise them of the issue. Additionally, the CE began updating its anti-phishing defenses and has upgraded its firewall. OCR provided the CE with technical assistance regarding the Security Rule including risk analysis and risk management.