Dignity Health dignityhealth.org Dignity Health data breach: what happened and what to do
In April 2018, a badly formatted email list sent a patient notice to 55,947 people that was meant for someone else. HHS says the information was the intended recipient's first name, last name and physician name.
View all 13,177 breaches- Breach date
- Apr 2018
- Affected
- 55,947
- Data exposed
- Names, Physician names
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
During a mass emailing of patient notifications in April 2018, Dignity Health used an email list that its business associate had formatted incorrectly. As a result, 55,947 people received an email that was meant for another individual.
According to the U.S. Department of Health and Human Services (HHS), the protected health information in each email was the intended recipient's first name, last name and physician name. HHS describes this as unauthorized access or disclosure. It was a mix-up, not an attack, and nothing in the description points to Social Security numbers, payment cards or passwords.
Dignity Health notified HHS, the affected individuals and the media. HHS's Office for Civil Rights obtained assurances about the corrective steps the organization took: it stopped using personalized greetings in mass patient emails, updated its policies on email communications, and named one person to review and approve every mass communication before it is sent.
The practical risk is small but real. A name and a doctor's name make a convincing opener for a phishing email or call that claims to be from a clinic or an insurer. Anyone who received one of these emails also learned a stranger's name and physician, which is why the company treated it as a breach.
If you received a mismatched email from Dignity Health, don't forward it and delete it once you have read the company's notice.
Sources checked: ocrportal.hhs.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Don't reply to or forward a mismatched email
If you got a message addressed to someone else, delete it. Don't forward it, because it contains another person's health information.
- 2
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls about this incident with suspicion. Don't click links in them. Go to the company's website directly, or call a number printed on your card or bill.
- 3
Check an unexpected message with the clinic directly
If a call or email claims to be about your care, hang up and call the office on a number from its website. Don't use contact details in the message.
- 4
Learn what to do after any breach
The FTC lists steps by data type at https://www.identitytheft.gov/databreach.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases and the dark web for your email and phone number and alerts you if they show up. It detects and alerts; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 31 May 2018 : 55,947 people
- California Attorney General , filed 13 Nov 2017
Timeline
-
Reported to the California Attorney General
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Dignity Health breach?
HHS says 55,947 people received an email meant for another person. If you got a mismatched patient email in April 2018, you were one of them.
What was exposed?
The intended recipient's first name, last name and physician name.
Were passwords or Social Security numbers exposed?
HHS's description doesn't list either.
Is there a settlement?
HHS's entry doesn't mention one. It says OCR obtained assurances about the corrective actions.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
