Liberty of Oklahoma

The business associate (BA), Liberty of Oklahoma Corporation, reported that an employee was the victim of an email phishing scheme that affected the protected health information (PHI) of 5,746 individuals. The PHI involved included names, dates of birth, addresses, phone numbers, Social Security numbers, and other identifying information. The BA notified HHS, affected individuals, local law enforcement, and the media. Complimentary credit monitoring was provided. In its mitigation efforts, the BA implemented additional administrative and technical safeguards to better protect PHI and sanctioned the responsible employee. Staff were retrained on email security. OCR provided technical assistance to the BA on the HIPAA Privacy and Security Rules.