Family Physicians of Winter Park

The covered entity (CE), Family Physicians of Winter Park, Inc., reported that an employee fell victim to an email phishing attack that affected the electronic protected health information (ePHI) of 8,429 patients. The ePHI involved included names, dates of birth, provider names, and health insurance information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE sanctioned the responsible employee and implemented additional administrative, technical, and security safeguards to better protect its ePHI. All staff were retrained on email security. OCR provided the CE with technical assistance regarding the HIPAA Breach Notification Rule.