Boulder Neurosurgical and Spine Associates

The covered entity (CE), Boulder Neurosurgical and Spine Associates, reported that an employee was the victim of an email phishing attack which affected the protected health information (PHI) of 21,450 individuals. The PHI involved included names, dates of birth, diagnoses, lab results, medications prescribed, and other treatment information. The CE closed its business; the investigation was subsequently closed.