American Medical Response

Pursuant to breach notification requirements, OCR received a breach report from American Medical Response, Inc. (AMR), the covered entity. Since this report was a duplicate of a previous breach notification to OCR, it was combined and the two transactions were resolved together. AMR reported that an unauthorized third party gained access to its employee email accounts maintained and administered by its business associate (BA). The email accounts contained the protected health information (PHI) of 4,300 individuals. The PHI involved included names, addresses, dates of birth, age, drivers’ license numbers, medical record numbers, account numbers, and Social Security numbers. As a result of this incident, AMR ended its business relationship with its business associate. The CE provided breach notification to the affected individuals and the media. AMR implemented additional security controls and re-trained its workforce to mitigate future email phishing attacks.