____________________________________________________________________ 

____________________________________________________________________ 

____________________________________________________________________ 

______________________________________________________________________ 

Notices Received by the FTC Pursuant to the

Health Breach Notification Rule 

The FTC’s Health Breach Notification Rule requires vendors of personal health records 

and PHR related entities to notify the FTC if they experience a breach of security 

involving unsecured PHR identifiable health information. For breaches involving the 

information of 500 or more individuals, entities must notify the FTC as soon as possible, 

and in any case no later than ten business days after discovering the breach. Breaches 

involving the PHR identifiable health information of fewer than 500 individuals may be 

reported in an annual submission that includes all breaches within the calendar year 

that fall within this category. The FTC has received the following notices pursuant to the 

reporting requirement related to 500 or more individuals. 

Intuit, Inc. 

City and State: Mountain View, CA 

Approximate # of Individuals Affected: 2094 

Date Breach was Discovered: 09/24/2010 

Type of Breach: Misdirected automated confirmation email 

Type of Information Involved: Health insurance information, other 

Microsoft Corporation 

City and State: Redmond, WA 

Approximate # of Individuals Affected: 10,078 

Date Breaches were Discovered: 08/29/2014 through 06/22/2016 

Type of Breach: Potential account compromise 

Type of Information Involved: Account credentials (i.e., username and password) 

involving Microsoft HealthVault personal health record information 

NoMoreClipboard, LLC 

City and State: Fort Wayne, IN 

Approximate # of Individuals Affected: 568,879 

Date Breach was Discovered: 05/26/2015 

Type of Breach: Hacker 

Type of Information Involved: Personal information (including name, address, date 

of birth, social security number) and personal health record information 

iHealth Labs 

City and State: Sunnyvale, CA 

Approximate # of Individuals Affected: 46,000 

Date Breach was Discovered: 02/13/2018 
______________________________________________________________________ 

______________________________________________________________________ 

Type of Breach: Hacker 

Type of Information Involved: Email addresses 

Vitagene, Inc. 

City and State: San Francisco, CA 

Approximate # of Individuals Affected: 2,700 

Date Breach was Discovered: 07/01/2019 

Type of Breach: Hacker 

Type of Information Involved: Name; date of birth; basic health information (age, 

sex, etc.); information about diet, exercise, weight, etc.; wellness recommendation 

reports, including partial genetic trait data and summary information; raw genotype data 

Billing, Cochran, Lyles, Mauro & Ramsey, P.A. 

City and State: Fort Lauderdale, FL 

Approximate # of Individuals Affected: 503 

Date Breach was Discovered: 10/19/2020 

Type of Breach: Hacker 

Type of Information Involved: Name; address; date of birth; Social Security number; 

medical record numbers; age; sex; height; disease or medical conditions; treatments or 

procedures 

Resource Seven 

City and State: Fayetteville, GA 

Approximate # of Individuals Affected: 9,649 

Date Breach was Discovered: 10/27/2023 

Type of Breach: Hacker 

Type of Information Involved: Name; address; date of birth; Social Security number; 

age; sex; height; weight; medications