December 27, 2022
Today, Utah Attorney General Sean D. Reyes is announcing, along with Oregon Attorney General Ellen Rosenblum, a data breach case settlement against Avalon Healthcare Management. Avalon provides nursing, therapy, senior and assisted living and other medical services in six states, including Utah and Oregon.
The total settlement amount is $200,000, split evenly between Utah and Oregon. The settlement comes after a 2019 data breach that exposed personal information and protected health information of 14,500 patients, including 4,038 Utahns.
A scammer gained access to Avalon’s email system in 2019, allowing access to names, addresses, social security numbers, dates of birth, driver’s license numbers, medical treatment information including diagnosis, health conditions, medications and financial information. Avalon notified patients affected by the breach 10 months after the breach occurred, as well as notifying federal and state regulators.
Avalon also agreed to increase data security and strengthen it’s information security program in order to safeguard personal information.
Read the agreement here.
Read the Oregon Attorney General’s Office press release here.