HHS OCR report · 2019
Women’s Health USA, Inc. data breach
OCR report facts
- Covered entity
- Women’s Health USA, Inc.
- Entity type
- Business Associate
- State
- Connecticut
- Individuals affected
- 17,531
- Submission date
- Mar 29, 2019
- Type of breach
- Hacking/IT Incident
- Location of breached information
- Desktop Computer, Email
- Business associate present
- Yes
- Status
- Archive (closed)
OCR description
On February 15, 2019, the covered entity (CE), Women’s Health USA, Inc., discovered a phishing attack that targeted employee emails and resulted in the unauthorized auto-forwarding of copies of incoming e-mails to an e-mail account unaffiliated with the CE or the employee. The incident affected the protected health information (PHI) of approximately 17,531 individuals and included patient’s names, dates of birth, Social Security numbers, Medicare claim numbers, health insurance policy numbers...
Text as published on the HHS OCR breach portal.
Frequently asked questions
How many people were affected by the Women’s Health USA, Inc. data breach?
The report to HHS OCR lists 17,531 individuals affected.
When was it reported to HHS?
It was submitted to HHS OCR on Mar 29, 2019.
What type of breach was it?
The OCR portal lists the type of breach as Hacking/IT Incident, with the breached information located in: Desktop Computer, Email.
Is the investigation still open?
No. The report is in the OCR portal archive, which holds reports where OCR has closed its review.
Is a breach notice letter from Women’s Health USA, Inc. legitimate?
This site cannot verify letters. Check the sender against the organisation's official website and the HHS OCR breach portal, and avoid calling numbers or clicking links only listed in an unexpected message. See our guide on what to do after a data breach notice.
Source: HHS OCR Breach Portal, OCR export October 2026. Network USA is not affiliated with HHS or Women’s Health USA, Inc..