Cancer Treatment Centers of America at Western Regional Medical Center

The covered entity (CE), Cancer Treatment Centers of America, reported that an employee was the victim of an email phishing attack affecting 41,948 individuals. The protected health information (PHI) involved included names, addresses, Social Security numbers, diagnoses/conditions, and treatment information. CTCA notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional administrative and technical safeguards and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.