County of Los Angeles Departments of Health and Mental Health

The County of Los Angeles, Department of Health and Mental Health (LAC), the covered entity (CE), reported that employee email accounts were breached in a phishing attack that affected the electronic protected health information (ePHI) of 749,017 individuals. Local law enforcement was notified. LAC also notified all affected individuals and the media. The CE hired a third party to conduct a comprehensive HIPAA security audit. In response to the breach, LAC employed additional remediation and mitigation efforts that include cyber features that help identify and block malicious emails, use of an authentication process that will better secure external access to internal emails, and restrictions on the use of personal email accounts. The CE provided all affected individuals with credit monitoring services and identity restoration consultation services.