Fred Hutchinson Cancer Center

Fred Hutchinson Cancer Center, , the covered entity (CE), reported that an employee was the subject of an email phishing scheme that compromised the protected health information (PHI) of 89,111 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, tax identification numbers, Social Security numbers, passport numbers, claims and financial information, health insurance information, diagnoses, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE provided complimentary credit monitoring and implemented additional administrative and technical safeguards. During the investigation, OCR provided the CE with technical assistance regarding the HIPAA Rules.