The covered entity (CE), Defense Health Headquarters, reported that its business associate (BA) was the victim of a cyber-attack that affected the electronic protected health information of 1,620 individuals. The ePHI involved included names, Social Security numbers, birthdates, health insurance information, addresses, and treatment information. The CE notified HHS and affected individuals. The BA implemented additional administrative, technical, and security safeguards to better protect its ePHI. OCR obtained assurances that the BA undertook the corrective actions noted.
