Absolute Dental Services

The business associate (BA), Absolute Dental Services, reported that an employee was the subject of an email phishing scheme that compromised the protected health information (PHI) of 10,037 individuals. The PHI involved included names, dates of birth, diagnoses and conditions, full face photos, and treatment information. The BA provided breach notification to the affected individuals, the media, the HHS Secretary, and posted substitute breach notice on its website. In response to the breach, the BA implemented multi-factor authentication for all email accounts, increased password complexity requirements, and implemented procedures for clients to send PHI to the BA using a secure file share or secure portal, rather than email.