HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 16, 2016.
- Organization as reported
- County of Los Angeles Departments of Health and Mental Health, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Dec. 16, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14327, row:5466)
- Archived copy
- Held in the private archive (provenance)
The County of Los Angeles, Department of Health and Mental Health (LAC), the covered entity (CE), reported that employee email accounts were breached in a phishing attack that affected the electronic protected health information (ePHI) of 749,017 individuals. Local law enforcement was notified. LAC also notified all affected individuals and the media. The CE hired a third party to conduct a comprehensive HIPAA security audit. In response to the breach, LAC employed additional remediation and mitigation efforts that include cyber features that help identify and block malicious emails, use of an authentication process that will better secure external access to internal emails, and restrictions on the use of personal email accounts. The CE provided all affected individuals with credit monitoring services and identity restoration consultation services.