HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 20, 2018.
- Organization as reported
- East End Disability Associates, Inc., NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Nov. 20, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13622, row:4761)
- Archived copy
- Held in the private archive (provenance)
East End Disability Associates, Inc., the covered entity (CE), discovered that a hacker compromised five employee email accounts and caused emails to be automatically forwarded to an external email address. The hacker may have accessed the full names, birthdates, addresses, account and identification numbers, diagnoses, and treatment information of 896 individuals. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE investigated and removed auto-forwarding rules and global administrative rights from the affected email accounts and reviewed other user accounts to confirm that forwarding rules had not been applied. The CE implemented additional technical safeguards including two-factor authentication for access to email accounts and computer login. The CE revised its policies and procedures regarding internal sharing of PHI and trained staff on the revised policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above. In addition, the CE is expected to develop and implement a risk management plan that addresses the process for managing and reducing the risks identified in the risk analysis to a reasonable and appropriate level.