HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 10, 2015.
- Organization as reported
- St.Vincent Medical Group, Inc., IN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 10, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14824, row:5963)
- Archived copy
- Held in the private archive (provenance)
St. Vincent Medical Group, Inc., the covered entity (CE), reported that on December 3, 2014, it learned that an employee’s user name and password had been compromised as a result of a phishing email attack. This breach affected approximately 756 individuals. The protected health information (PHI) involved in the breach included names, addresses, dates of birth, clinical information, and in some cases, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE disabled and reset the password for the email account responsible for the breach, and required the employee to reset their password. It also deployed software to scan internet addresses in employees’ emails to determine if they are malicious, and required phishing training for all employees. OCR obtained documented assurances that the CE implemented the corrective action steps listed above.