Comprehensive Health Services chsfl.com Comprehensive Health Services data breach: what happened and what to do
Comprehensive Health Services, a provider of workplace medical services, reported a 2020 breach affecting 106,752 people. Per HHS, names, Social Security numbers and drug testing invoices were involved. Notices went out in 2022.
View all 13,177 breaches- Breach date
- 9 Apr 2020
- Made public
- 15 Feb 2022
- Affected
- 106,752
- Data exposed
- Names, Social security numbers, Drug testing invoices
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Comprehensive Health Services (CHS) provides occupational health services, which means many people in this breach never chose CHS themselves: their employer did.
What happened
According to the U.S. Department of Health and Human Services (HHS), CHS reported that several employees fell for an email phishing scheme that compromised the protected health information of 106,752 people. State filings put the start of the incident at April 9, 2020, and the company's notices to the California and Washington attorneys general came in February 2022. Maine's attorney general record also lists the breach as an external system breach, so the exact attack path differs between filings. We use HHS's wording here.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, maine.gov
Last verified against the official page:
What was exposed
HHS says the information included names, Social Security numbers and drug testing invoices. A Social Security number plus a name is enough to try to open credit in your name or file a fake tax return, and it stays useful to criminals for years. Drug testing invoices can reveal that you were tested for a job, which phishers could use to sound legitimate.
The company's response
HHS says CHS notified HHS, the people affected and the media, posted a substitute notice on its website, offered complimentary credit monitoring and added administrative and technical safeguards.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains.
- 2
Take the free credit monitoring if you were offered it
The notice letter explains how to enroll. The FTC recommends using it if a company offers it.
- 3
Read your statements and explanation of benefits
Check bank, card and insurance statements for charges or treatment you don't recognize, and report fraud at IdentityTheft.gov.
- 4
Expect phishing that mentions the breach
Don't click links or call numbers in unexpected emails, texts or letters. Contact the company using details from its official site.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which of your details have turned up in breach databases.
Frequently asked
Was I affected by the Comprehensive Health Services breach?
If CHS or your employer sent you a notice letter, yes. If you had an employment-related medical or drug test through CHS, check the notice details on the company's website or contact CHS directly.
What was exposed in the Comprehensive Health Services breach?
HHS lists names, Social Security numbers and drug testing invoices.
Should I freeze my credit?
If your Social Security number was in the notice, the FTC says a free credit freeze at Equifax, Experian and TransUnion is a strong step.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
