Chase Brexton Health Care

An unauthorized user gained access to four employees’ email accounts after a phishing attack. The breach included the protected health information of 16,562 individuals and included names, addresses, dates of birth, financial information, and diagnostic information. Following the breach, the covered entity implemented two-factor authentication for its email system and trained employees on cybersecurity. OCR reviewed the covered entity’s risk analysis to ensure compliance with the Security Rule.