Center for Alternative Sentencing and Employment Services

The covered entity (CE), Center for Alternative Sentencing and Employment Services, reported that employees were the victims of an email phishing attack that compromised the protected health information (PHI) of 3,994 individuals. The PHI involved included names, dates of birth, Social Security numbers, drivers’ license numbers, passport numbers, financial and health insurance information, diagnoses, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In addition, the CE offered one year of complimentary identity monitoring services. In its mitigation efforts, the CE implemented additional technical safeguards and retrained its workforce on email security.