Guardian Pharmacy of Jacksonville

Guardian Pharmacy of Jacksonville, the covered entity (CE), reported that an employee fell victim to an email phishing scheme. The breach affected 11,521 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, treatment and diagnosis information, Social Security numbers, drivers’ license numbers, insurance information, and financial information. The CE provided breach notification to HHS, all affected individuals, the media, and posted the details of the breach incident on its website. Additionally, in response to this incident and OCR’s investigation, the CE adopted new password length and complexity requirements, implemented an account lockout mechanism, increased firewall protections and patch management, sanctioned the employee whose email account was affected, and retrained its staff. Guardian adopted and implemented a new security policy. OCR obtained assurances that the CE implemented the corrective actions noted above.