On December 5, 2024, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a civil penalty of $548,265 against Children’s Hospital Colorado for violations of the HIPAA Privacy and Security Rules. These violations stemmed from security breaches in 2017 and 2020, linked to email phishing and cyberattacks. The investigation found that one breach occurred when multi-factor authentication was disabled on an email account, exposing 3,370 individuals’ Protected Health Information (PHI). The second breach involved three email accounts compromised by unknown third parties, affecting 10,840 individuals’ PHI.
