The covered entity (CE), Health First, Inc., discovered on May 31, 2018, that a phishing attack compromised 38 email accounts beginning in February 2018. The breach affected the protected health information (PHI) of 41,810 individuals, including demographic financial, clinical, and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE sanctioned and retrained employees. It also revised technical safeguards for its email system and enhanced its user activity monitoring procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.
