- State
- MD
- Covered entity type
- Healthcare Provider
- Individuals affected
- 16,562
- Business associate present
- No
- Type of breach
- Hacking/IT Incident
- Location of breached information
- First seen by InfoSec Signals
- Sep 23, 2026
- Last seen in OCR export
- Oct 25, 2026
OCR description
An unauthorized user gained access to four employees’ email accounts after a phishing attack. The breach included the protected health information of 16,562 individuals and included names, addresses, dates of birth, financial information, and diagnostic information. Following the breach, the covered entity implemented two-factor authentication for its email system and trained employees on cybersecurity. OCR reviewed the covered entity’s risk analysis to ensure compliance with the Security Rule.
Change history
- Sep 23, 2026Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights about this source
Records are reproduced as published; entity names and figures are OCR's.