Employees of the covered entity (CE), Children’s National Medical Center (CNMS), responded to phishing emails they believed were legitimate emails. Over 20,000 individuals were affected by the breach which involved demographic, clinical and health insurance information, including a limited number of social security numbers. The CE provided breach notification to HHS, affected individuals, and the media, and offered 12 months of free identity monitoring for those whose social security number was compromised. Following the breach, the CE identified source attacks, remediated accounts, removed exfiltration software, and implemented safeguards to increase firewall protections and inspection of e-mails (monitoring, scanning, and rewriting of embedded Internet addresses). In addition, the CE updated its security policy and retrained employees. OCR obtained assurances that the CE has implemented the corrective actions listed above.
