On November 1, 2017, an employee at the Colorado Mental Health Institute in Pueblo mistyped a website address into her computer browser and accessed an imposter site that downloaded malware to her computer. Her subsequent attempts to fix the problem allowed the malware company to access the protected health information (PHI) of 639 individuals, including demographic, clinical, and financial information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE conducted a forensic investigation, sanctioned the responsible employee, and augmented existing employee training with additional information regarding malware attacks and social engineering. OCR obtained assurances that the CE implemented the listed corrective actions.
