Avalon Health Care Management

The business associate (BA), Avalon Health Care Management, Inc., reported that an employee was the victim of an email phishing attack that compromised the protected health information (PHI) of 2,717 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, drivers’ license numbers, diagnoses, medications prescribed, and other treatment information. In response to the breach, the BA implemented additional technical safeguards, provided workforce members with HIPAA Privacy and Security Rule training, and developed additional policies and procedures. OCR provided technical assistance to the BA regarding the HIPAA Rules.