HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 17, 2018.
- Organization as reported
- Inogen, Inc., CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 17, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13850, row:4989)
- Archived copy
- Held in the private archive (provenance)
On April 17, 2018, Inogen, Inc., the covered entity (CE), reported that an unauthorized individual hacked data from its systems by gaining access to an email account belonging to an employee and setting up forwarding of email messages to an unknown, external email address from January 2, 2018 until March 14, 2018. The breach affected approximately 29,000 individuals and the types of protected health information (PHI) compromised included names, addresses, telephone numbers, dates of birth, dates of death, Medicare identification numbers, insurance policy information, and medical equipment provided. The CE provided breach notification to affected individuals, the media, and HHS. As a result of this incident, the CE strengthened its security controls, such as disabling the ability of email users to set forwarding rules, requiring all email users and administrators to change their passwords, and implementing dual-factor authentication for remote email access. OCR obtained assurances that the CE implemented the corrective action steps noted above.