Forrest General Hospital

Horne CPAs & Business Advisors, a business associate (BA) of Forrest General Hospital (CE), discovered that a staff member’s email account was sending out suspicious emails after being compromised in a phishing attack. The BA investigated the incident, and determined that an email attachment to one of the emails in the compromised account contained the protected health information (PHI) of 1,671 of the CE’s patients. The types of breached PHI included names, Medicaid numbers, dates of service, dates of birth, patient account numbers, and Social Security numbers. The BA notified the CE, and worked with the CE to meet the requirements of the Breach Notification Rule. The BA provided breach notification to the affected individuals and the media. The CE provided notice to HHS and on its website. The BA sanctioned the employee involved and, in response to this incident and OCR’s investigation, the BA implemented several technical security improvements. OCR obtained assurances that the CE implemented the corrective actions listed above.