Behavioral Health Network

The covered entity (CE), Behavioral Health Network, Inc., reported that it was the victim of a malware attack affecting the electronic protected health information (ePHI) of 129,571 individuals. The ePHI involved included names, addresses, dates of birth, Social Security numbers, clinical information, claims and health insurance information. The CE notified HHS, affected individuals, the media, and provided complimentary credit monitoring and identity protection services to affected individuals. In response to the breach, the CE implemented additional technical safeguards, and implemented a cybersecurity committee to regularly review and implement changes as needed. OCR obtained assurances that the CE implemented the corrective actions noted.