Good Samaritan Hospital

The covered entity (CE), Good Samaritan Hospital, Inc. reported that it experienced a series of phishing email attacks, which resulted in the breach of 233,835 individuals’ protected health information (PHI). The CE became a part of PIH Health, Inc. (PIH Health) in December 2019, and OCR consolidated its investigation of this breach with another breach involving email phishing attacks against PHI Health, which we settled with a resolution agreement and corrective action plan. The settlement resolves an investigation that OCR conducted after receiving PIH Health’s breach report, which stated that in June 2019, a phishing attack compromised forty-five of its employees’ email accounts, resulting in the breach of 189,763 individuals’ unsecured electronic PHI. PIH Health reported that the ePHI disclosed in the phishing attack included affected individuals’ names, addresses, dates of birth, driver’s license numbers, Social Security numbers, diagnoses, lab results, medications, treatment and claims information, and financial information. OCR’s investigation found multiple potential violations of the HIPAA Rules. Under the terms of the resolution agreement, PIH Health has agreed to impleme