Agency for Health Care Administration

On November 20, 2017, the Agency for Health Care Administration, the covered entity (“CE”), discovered that one of its employees had been the victim of a phishing incident, potentially exposing the names, dates of birth, addresses, social security numbers, clinical and health insurance information of 29,641 individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media. At the time of the breach and currently, the CE trained its employees on its HIPAA policies and procedures and including the reporting of suspicious emails. In response to the breach, the CE retrained the employee at fault and its entire workforce on identifying and reporting potential phishing emails. OCR obtained assurances that the CE implemented the corrective actions listed above.