A hacker attacked the covered entity’s (CE) computer system via a phishing email, potentially affecting the protected health information (PHI) of 1,112 individuals. The types of PHI involved in the breach included demographic, clinical, and health insurance information. The CE provided breach notification to HHS and affected individuals. OCR obtained evidence of the CE’s risk analysis and safeguards implemented prior to the breach. As a result of OCR’s investigation, the CE strengthened its administrative and technical safeguards, including providing additional workforce member training to identify phishing attempts, implementing multi-factor authentication to its email account, adding enhanced email monitoring, and increasing password complexity.
