HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 25, 2017.
- Organization as reported
- MGA Home Healthcare Colorado, Inc., AZ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 25, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14019, row:5158)
- Archived copy
- Held in the private archive (provenance)
On October 25, 2017, MGA Home Healthcare Colorado, Inc., the covered entity (CE), reported that a workforce member fell victim to an email phishing attack. The breach included the protected health information (PHI) of approximately 10,871 individuals and included demographic information and health insurance information, claims histories, dispute information, health plan beneficiary numbers, and subscriber identification. The CE provided breach notification to HHS, affected individuals, and the media and provided individuals with free credit monitoring. Following the breach, the CE strengthened password requirements, updated its Security Rule management plan, implemented new technical safeguards, revised policies and procedures, sanctioned the involved workforce members, and retrained workforce members. As a result of OCR’s investigation, the CE implemented multifactor authentication on its email accounts to reduce the risk of a similar phishing attack impacting PHI in the future.