As the result of a phishing attack, on June 7, 2018, and June 14, 2018, unauthorized users accessed three email accounts containing the protected health information (PHI) of 790 individuals; however, there is no evidence that the emails containing the PHI were actually accessed. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the covered entity (CE) blocked the email sender, blocked the hyperlink in the web appliance, and sent a communication to the recipients of the phishing attack notifying them of the phishing email. The CE also required staff to reset passwords and trained staff regarding phishing emails. In addition, the CE implemented administrative and technical safeguards for emails by restricting bulk email, restricting the affected accounts from sending external emails, and deploying scripts to search and delete malicious emails from email exchange servers. OCR reviewed the CE’s individual breach notification and the security measures it implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.
