Alameda Health System alamedahealthsystem.org Alameda Health System data breach: what happened and what to do
Alameda Health System, a public health system in Alameda County, California, reported that employee email accounts were accessed by an unauthorized party. HHS lists up to 90,000 people. Demographic, clinical and financial information was involved. Notice letters went out in June 2022.
View all 13,177 breaches- Breach date
- 30 Apr 2020
- Made public
- 24 Jun 2022
- Affected
- 90,000
- Data exposed
- Demographic information, Clinical information, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Alameda Health System (AHS) runs hospitals and clinics in Alameda County, California. In 2022 it told regulators that an unauthorized party had gained access to several employee email accounts. The U.S. Department of Health and Human Services (HHS) describes the cause as an email phishing scheme aimed at multiple employees. AHS posted a notice letter to the California Attorney General's breach site dated June 24, 2022, and the HHS breach portal lists up to 90,000 people.
The California listing gives April 30, 2020 as the breach date. Notices went out more than two years later, which is common with email breaches: the organization has to work out which messages and attachments sat in the accounts and who they mention.
Sources checked: oag.ca.gov, ocrportal.hhs.gov, hipaajournal.com
Last verified against the official page:
What was exposed
HHS says the information involved was demographic, clinical and financial. Think of the details that fill a patient record or a billing email: name, address, date of birth, treatment details, insurance or payment information. HHS doesn't list Social Security numbers among them. Your own letter lists what applies to you.
What it lets criminals do
Clinical and billing details make phishing more convincing. A message that names your provider and a real appointment looks like the real thing. Insurance details can also be used for medical identity theft, where someone gets care or files claims under your name.
How AHS responded
According to HHS, AHS changed passwords, strengthened its password requirements, added technical safeguards and carried out a HIPAA Security Rule risk analysis. It notified HHS, the people affected and the media.
If you were a patient, read the letter before you read any news about it. It says what was involved in your case and whether AHS offers free credit monitoring. Serus can't remove breach data, but it monitors breach databases and the dark web for your email and phone number and alerts you if they show up.
What to do if you were in it
- 1
Read your notice letter
It lists which of your details were involved and any free services AHS offers. Keep it with your records.
- 2
Check your insurance statements
Read the explanation of benefits your insurer sends and question any care or claim you don't recognize. The FTC explains how to report medical identity theft at identitytheft.gov.
- 3
Freeze your credit if your letter says your Social Security number was involved
A freeze is free and you place it separately at Equifax, Experian and TransUnion, as the FTC explains.
- 4
Treat messages that mention AHS as suspect
Don't click links or call numbers in unexpected emails or texts about your care or a bill. Contact the provider using a number from its official site.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email or phone number.
Official filings
- U.S. Department of Health and Human Services , filed 20 May 2022 : 90,000 people
- U.S. Department of Health and Human Services , filed 15 Sept 2020 : 2,691 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
Reported to U.S. Department of Health and Human Services
-
The company made it public
Frequently asked
Was I affected by the Alameda Health System breach?
If AHS sent you a notice letter, yes. HHS lists up to 90,000 people. If you think you were a patient and got no letter, ask AHS directly.
What was exposed?
HHS describes demographic, clinical and financial information. The exact details differ by person and are listed in your letter.
Should I change my password?
The accounts that were accessed belonged to AHS employees, not patients, so there is no patient password to reset. Change a password if you reused one on a patient portal, and stay alert for phishing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
