HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Dec. 27, 2017.
- Organization as reported
- Colorado Department of Human Services, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- Dec. 27, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13956, row:5095)
- Archived copy
- Held in the private archive (provenance)
On November 1, 2017, an employee at the Colorado Mental Health Institute in Pueblo mistyped a website address into her computer browser and accessed an imposter site that downloaded malware to her computer. Her subsequent attempts to fix the problem allowed the malware company to access the protected health information (PHI) of 639 individuals, including demographic, clinical, and financial information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE conducted a forensic investigation, sanctioned the responsible employee, and augmented existing employee training with additional information regarding malware attacks and social engineering. OCR obtained assurances that the CE implemented the listed corrective actions.