The covered entity (CE), Iowa Department of Human Services, reported that several employees were subject to an email phishing scheme that affected the protected health information (PHI) of 811 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, claims and financial information, diagnoses, lab results, and medications. The CE notified HHS, affected individuals, and the media. In response to the breach the CE provided complimentary credit monitoring services and strengthened its technical safeguards and sanctioned the responsible employees. Staff were also retrained on email security.
