HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 26, 2017.
- Organization as reported
- MultiCare Health System, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Jan. 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14290, row:5429)
- Archived copy
- Held in the private archive (provenance)
MultiCare Health System, the covered entity (CE), reported that due to a phishing attack a hacker gained access to an employee’s email access credentials for approximately 3 days. The breach affected the protected health information (PHI) of 1,249 individuals and included names, dates of birth, dates of service, diagnoses, medical record numbers, and descriptions of treatment. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE updated its policies and procedures addressing phishing emails, implemented technical security safeguards to reduce the risk of malware infection and hacking, and retrained all employees on its updated policies and procedures. OCR provided the CE with comprehensive technical assistance regarding its obligations under the Security Rule to conduct a thorough security risk analysis and implement a corresponding risk management/mitigation plan. OCR also provided an explanation of the requirements of the Security Rule for the CE to use in future compliance efforts. OCR obtained documented assurances that the CE implemented the corrective actions listed above.