Critical Care, Pulmonary and Sleep Associates, PLLP

Critical Care Pulmonary and Sleep Associates, PLLP, the covered entity (CE), reported a phishing attack led to the compromise of six of the CE’s email accounts. The CE determined that third parties may have had access to the electronic protected health information (ePHI) in such email accounts leading to the breach of 23,377 individuals’ ePHI. The ePHI contained in the email accounts included names, addresses, dates of birth, driver’s license numbers, claims information, financial information, diagnoses/conditions, lab results, medications, and other treatment information. In response to the breach incident, Critical Care Pulmonary and Sleep Associates notified affected individuals of the breach, notified prominent media outlets of the breach, and sanctioned the workforce member who fell victim to the phishing attack. The CE also implemented additional technical controls to better safeguard its ePHI, updated its security awareness and HIPAA policies and procedures, and retrained its workforce. OCR provided the CE with technical assistance.