Legacy Health

On June 21, 2018, the covered entity (CE), Legacy Health, learned that an unauthorized third party may have gained access to some employees’ email accounts in May 2018, affecting approximately 38,000 individuals. The types of protected health information (PHI) involved in the breach included patients’ names, dates of birth, insurance information, billing information, driver's license numbers, Social Security numbers and medical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE began an investigation and engaged a law firm and other companies to assist. As a result of OCR’s investigation, the CE implemented enhanced email security protections, implemented multi-factor authentication for all users on all of its systems, and enhanced malware defenses on its firewall.