Interactive Medical Systems

Interactive Medical Systems, Corp., a business associate (BA), reported that multiple employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 15,010 individuals. The ePHI involved included names, addresses, dates of birth, Social Security numbers, and financial and health insurance information. The BA notified HHS, affected individuals, the media, the FBI, and the New York Attorney General. Following the breach incident, the BA implemented additional administrative, technical, and security safeguards to better protect its ePHI, including revising its policies and conducting an updated risk analysis. All employees were retrained. OCR obtained assurances that the BA implemented the corrective actions noted.