Froedtert Health, the covered entity (CE), reported that it was the victim of a cyber-attack affecting the protected health information (PHI) of approximately 43,549 individuals. The PHI involved included names, dates of birth, telephone numbers, addresses, diagnoses/conditions, Social Security numbers, lab results, medications prescribed, medical record numbers, and other treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. The CE also provided complimentary credit monitoring services to affected individuals and set up a toll free phone number for questions or concerns. In its mitigation efforts, the CE implemented administrative and technical safeguards and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.
