HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 27, 2018.
- Organization as reported
- Confluence Health, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- July 27, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13736, row:4875)
- Archived copy
- Held in the private archive (provenance)
A Confluence Health employee received and responded to a phishing email on March 29, 2018. An unauthorized entity accessed the employee’s email account from a Nigerian internet address on March 30, 2018, and again on May 28, 2018, sent phishing emails to multiple recipients, and entered a setting to automatically delete all sent emails. The employee’s email account contained protected health information (PHI), including approximately 32,821 patients’ names and treatment information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. Following the breach, the CE disabled the compromised email account, blocked certain internet addresses, and required a password reset of all its computer network accounts. Additionally, the CE created alert notifications for access to accounts, enabled anti-phishing protections for its email system, heightened its reviews of network activity, implemented multi-factor authentication, and disabled certain types of access from outside its network. OCR provided technical assistance regarding the CE’s security management process.