Carpenters Benefit Funds of Philadelphia

An unauthorized user gained access to multiple employees’ email accounts after a phishing attack. The breach included the protected health information (PHI) of 20,015 individuals and included names, social security numbers, driver’s license numbers, bank account information, health insurance information, and medical treatment information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media; however, it did so more than 60 days after discovery of the incident on May 2, 2018. Following the breach, the CE implemented new procedures for employees to open encrypted emails and retrained employees on its security policies and procedures. OCR reviewed the CE’s newly revised risk analysis to ensure compliance with the Security Rule and provided technical assistance to the CE regarding timely breach notification.