HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 17, 2020.
- Organization as reported
- Good Samaritan Hospital, Inc., CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 17, 2020
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 12912, row:4051)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Good Samaritan Hospital, Inc. reported that it experienced a series of phishing email attacks, which resulted in the breach of 233,835 individuals’ protected health information (PHI). The CE became a part of PIH Health, Inc. (PIH Health) in December 2019, and OCR consolidated its investigation of this breach with another breach involving email phishing attacks against PHI Health, which we settled with a resolution agreement and corrective action plan. The settlement resolves an investigation that OCR conducted after receiving PIH Health’s breach report, which stated that in June 2019, a phishing attack compromised forty-five of its employees’ email accounts, resulting in the breach of 189,763 individuals’ unsecured electronic PHI. PIH Health reported that the ePHI disclosed in the phishing attack included affected individuals’ names, addresses, dates of birth, driver’s license numbers, Social Security numbers, diagnoses, lab results, medications, treatment and claims information, and financial information. OCR’s investigation found multiple potential violations of the HIPAA Rules. Under the terms of the resolution agreement, PIH Health has agreed to implement a corrective action plan that will be monitored by OCR for two years and paid a $600,000 settlement to OCR. Under the corrective action plan, PIH is obligated to take definitive steps toward resolving potential violations of the HIPAA Rules, including: (1) conducting an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI; (2) developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis; (3) developing, maintaining, and revising, as necessary, its written policies and procedures to comply with the HIPAA Rules; and (4) training its workforce members who have access to PHI on its HIPAA policies and procedures. The…