Hill Country Memorial Hospital

The covered entity (CE), Hill Country Memorial Hospital, reported that on February 21, 2017, its workforce member responded to a phishing email and provided her username and password, which allowed an unknown person to gain access to the workforce member’s email account and send fake invoices to the CE for payment. The breach potentially affected the protected health information (PHI) of 8,449 individuals and may have included patients' names, addresses, dates of birth, Social Security numbers, and medical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE trained its workforce on security awareness, addressing phishing emails, ransomware, the use of strong passwords, and cyber threats. Additionally, the CE sent internal email users an email banner with additional warnings about emails that contain links and are from outside the organization and set up an internal phishing inbox for users to submit potential threats. OCR obtained assurances that the CE implemented the corrective actions listed above.