On July 27, 2016, a phishing e-mail was sent to 155 employees of the covered entity (CE), Baystate Health, Inc. Five employees responded to the phishing e-mail, which allowed the hackers to gain access to their e-mail accounts, potentially affecting the protected health information (PHI) of 13,112 individuals. The types of PHI that was potentially exposed may have included patients’ names, demographic information, dates of birth, diagnoses, treatments, medical record numbers, and in some instances, health insurance identification numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE retrained employees, issued additional phishing reminders to all employees, and incorporated additional information about phishing into various trainings. Additionally, the CE improved technical safeguards. OCR reviewed the CE's HIPAA policies and procedures as related to this breach for compliance with the Privacy and Security Rule and obtained assurances that the CE implemented the corrective actions listed above.
