Defense Health Agency, the covered entity (CE), reported that its business associate (BA) was the subject of a cyber-attack that compromised the protected health information (PHI) of 1,279 individuals. The PHI involved included names and medication information. The CE notified HHS and the affected individuals. The BA implemented additional administrative, technical, and security safeguards to protect PHI.
