Canby Clinic Data Breach 2025: 549 Patients Affected by Email Account Incident in Oregon

Canby Clinic, a naturopathic medical practice in Canby, Oregon, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on April 30, 2025, reporting 549 affected individuals in an Unauthorized Access/Disclosure event involving an employee email account. Subsequent filings with the Oregon Department of Justice confirmed the unauthorized-access window ran from April 22, 2025 through May 7, 2025, was discovered on April 25, 2025, and prompted written notifications to affected Oregon residents on May 12, 2025.

Timeline

• April 22, 2025 — Earliest date of confirmed unauthorized access to a Canby Clinic employee email account.
• April 25, 2025 — Canby Clinic detects the unauthorized activity and begins its internal review.
• April 30, 2025 — Canby Clinic files the breach with HHS OCR, categorized as Unauthorized Access/Disclosure at the location “Email,” with 549 individuals affected.
• May 7, 2025 — End of the confirmed access window as reported to Oregon regulators.
• May 12, 2025 — Individual notification letters mailed to affected residents.
• May 17, 2025 — Breach reported to the Oregon Department of Justice under ORS 646A.604.

What was exposed

The OCR portal entry classifies the incident as an Unauthorized Access/Disclosure event with the location of breached information listed as Email. Neither the OCR portal entry nor the Oregon DOJ summary publicly itemizes the specific data elements present in the compromised mailbox. The compromised mailbox contents may have included protected health information typical of provider correspondence (names, dates of birth, treatment-related communications, billing details), but Canby Clinic has not published a substitute notice itemizing the specific data fields involved. Individuals who received a notification letter should rely on the letter’s enumerated list of data elements rather than this page.

What Canby Clinic is offering

No complimentary credit-monitoring or identity-protection offering has been publicly disclosed by Canby Clinic on its website or in the publicly available regulatory filings. Affected individuals who received a notification letter should refer to the letter for any remediation services included.

Class action

No class-action complaint against Canby Clinic has been publicly filed or docketed as of the last update to this page. With an affected population of 549, the breach falls below the threshold at which plaintiffs’ firms typically initiate consumer-protection class litigation, though Oregon residents retain individual statutory claims under ORS 646A.604.

What to do if you may be affected

• Read the May 12 notification letter carefully. Canby Clinic’s letter is the authoritative source for the specific data elements involved in your record and any remediation offered.
• Freeze your credit with the three nationwide consumer reporting agencies. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against identity theft when health-record correspondence is implicated.
• Watch your Explanation of Benefits statements from your health insurer for treatment or charges you did not authorize, which is the most common downstream signal of medical-identity fraud.
• Contact Canby Clinic directly with questions about your record’s exposure. The practice’s general contact information is on its website at canbyclinic.com.
• File a complaint with the Oregon Department of Justice if you believe the notification was delayed or incomplete relative to Oregon’s 45-day statutory requirement.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Oregon Department of Justice — Data Breach Notification Database — state-level record including the breach window, discovery date, and individual-notification date.
• Oregon DOJ Consumer Protection — Data Breaches — overview and search portal for Oregon breach filings.
• Canby Clinic — the entity’s public-facing website.
• Oregon breach notification statute (ORS 646A.604) — the statute governing individual notification and Attorney General reporting deadlines applicable to this incident.