HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 25, 2018.
- Organization as reported
- Progressions Behavioral Health Services, Inc., PA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- June 25, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13775, row:4914)
- Archived copy
- Held in the private archive (provenance)
An unauthorized user gained access to employees’ email account after a phishing attack and set the employees’ emails to automatically forward to an external account. The breach involved the protected health information (PHI) of 1,303 individuals and included clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented multi-factor authentication for its email accounts and implemented a new privacy and security training program for employees. Additionally, OCR ensured that the CE completed an appropriate risk analysis after the breach.