Broome County, New York

The covered entity (CE), Broome County, New York, reported that multiple employees were victims of an email phishing attack that affected the electronic protected health information (ePHI) of 7,048 individuals. The ePHI involved included names, Social Security numbers, financial information, dates of birth, medical record numbers, patient identification numbers, diagnoses and treatment information, and health insurance and claims information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. The CE also provided affected individuals with complimentary credit monitoring and identity theft protection services. Following the breach, the CE strengthened its technical and security safeguards and retrained its staff on email security.