HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 21, 2017.
- Organization as reported
- Hill Country Memorial Hospital, TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14209, row:5348)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Hill Country Memorial Hospital, reported that on February 21, 2017, its workforce member responded to a phishing email and provided her username and password, which allowed an unknown person to gain access to the workforce member’s email account and send fake invoices to the CE for payment. The breach potentially affected the protected health information (PHI) of 8,449 individuals and may have included patients' names, addresses, dates of birth, Social Security numbers, and medical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE trained its workforce on security awareness, addressing phishing emails, ransomware, the use of strong passwords, and cyber threats. Additionally, the CE sent internal email users an email banner with additional warnings about emails that contain links and are from outside the organization and set up an internal phishing inbox for users to submit potential threats. OCR obtained assurances that the CE implemented the corrective actions listed above.