Alana Healthcare

From December 26, 2018, to January 17, 2019, an unauthorized intruder accessed an employee’s email through a phishing incident, potentially gaining access to 2,691 individuals’ names, dates of birth, Social Security numbers, doctors’ notes, medication types, and facilities where the patients were seen. To mitigate the breach, the covered entity (CE), Alana Healthcare, deactivated the affected email account, implemented multi-factor authentication, changed email passwords, trained employees on phishing, and conducted a risk analysis. The CE provided breach notification to HHS, affected individuals, and the media in April 2019.