The business associate (BA), BJC Health System, reported that several employees were the subjects of an email phishing scheme that affected the protected health information (PHI) of 287,876 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, Social Security numbers, diagnoses, medical conditions, lab results, and medications prescribed. The BA notified HHS, affected individuals, the media, and provided substitute notice. The BA also provided complimentary credit monitoring and identity protection services. In its mitigation efforts, the BA strengthened its administrative and technical safeguards and retrained its staff on email security.
