HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 21, 2019.
- Organization as reported
- Critical Care, Pulmonary and Sleep Associates, PLLP, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Jan. 21, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13565, row:4704)
- Archived copy
- Held in the private archive (provenance)
Critical Care Pulmonary and Sleep Associates, PLLP, the covered entity (CE), reported a phishing attack led to the compromise of six of the CE’s email accounts. The CE determined that third parties may have had access to the electronic protected health information (ePHI) in such email accounts leading to the breach of 23,377 individuals’ ePHI. The ePHI contained in the email accounts included names, addresses, dates of birth, driver’s license numbers, claims information, financial information, diagnoses/conditions, lab results, medications, and other treatment information. In response to the breach incident, Critical Care Pulmonary and Sleep Associates notified affected individuals of the breach, notified prominent media outlets of the breach, and sanctioned the workforce member who fell victim to the phishing attack. The CE also implemented additional technical controls to better safeguard its ePHI, updated its security awareness and HIPAA policies and procedures, and retrained its workforce. OCR provided the CE with technical assistance.