The covered entity, FedEx Corporation Group Health Plan, reported that a vendor of its business associate (BA) experienced a cyber-attack that compromised the protected health information (PHI) of 553 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, diagnoses, lab results, medications, claims and financial information, and other treatment information. The CE notified HHS, and the affected individuals. In its mitigation efforts, the CE and BA implemented additional administrative, technical, and security safeguards to better protect PHI.
