Diagnostic Radiology & Imaging

On November 11, 2017, an unauthorized user accessed the email account of a Diagnostic Radiology & Imaging employee via a successful phishing attack. The breach affected the protected health information (PHI) of 799 individuals and included names, email addresses, phone numbers, dates of birth, descriptions of imaging services provided, medical record numbers, and patients’ comments. The covered entity (CE) provided breach notification to HHS, affected individuals, the media, and on its website. In response to the breach and OCR’s investigation, the CE disabled the affected email account, required its employees to complete additional cybersecurity training, and provided additional education to employees on how to identify phishing attempts. The CE’s chief operation officer began meeting with employees bi-weekly to discuss security issues. The CE started issuing a weekly newsletter regarding phishing attacks and it implemented multi-factor authentication for all email account holders. OCR obtained assurances that the CE implemented the corrective actions listed above.