On October 25, 2017, MGA Home Healthcare Colorado, Inc., the covered entity (CE), reported that a workforce member fell victim to an email phishing attack. The breach included the protected health information (PHI) of approximately 10,871 individuals and included demographic information and health insurance information, claims histories, dispute information, health plan beneficiary numbers, and subscriber identification. The CE provided breach notification to HHS, affected individuals, and the media and provided individuals with free credit monitoring. Following the breach, the CE strengthened password requirements, updated its Security Rule management plan, implemented new technical safeguards, revised policies and procedures, sanctioned the involved workforce members, and retrained workforce members. As a result of OCR’s investigation, the CE implemented multifactor authentication on its email accounts to reduce the risk of a similar phishing attack impacting PHI in the future.
