How many breaches , how many compromises of patients ' confidential medical information does it take before there are some questions asked of an organization and its security policies ? One health system , for instance , recently announced its seventh large HIPAA breach . The 20 - hospital St. Vincent health system in Indianapolis , part of Ascension Health , most recently notified 760 of its medical group patients that their Social Security numbers and clinical data was compromised in an email phishing incident . The breach , which was discovered by hospital officials back in December 2014 , marked the seventh breach for the health system in a less than five years . t was n't until March 12 , 2015 , that officials said they discovered which patients were impacted by the breach , which involved the compromise of an employee 's network username and password . " St. Vincent Medical Group sincerely apologizes for any inconvenience this unfortunate incident may cause , " St. Vincent officials wrote in the patient notification letter . According to data from the Office for Civil Rights , which keeps track of HIPAA breaches involving 500 people or more , St. Vincent health system has been a repeat HIPAA offender . Its most recent breach , reported in July 2014 , compromised the health data of 63,325 patients after a clerical error sent patients letters to the wrong patients . The health system has also reported two breaches involving the theft of unencrypted laptops , which collectively compromised the health data of 2,341 patients . ;