Mount Carmel Behavioral Health

Mount Carmel Behavioral Health, a covered entity (CE), reported that one of its employees was the target of an email phishing scheme affecting the protected health information (PHI) of 1,221 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, diagnoses, conditions, and other treatment information. The CE notified HHS, affected individuals, and the media. The CE took several corrective actions in response to the breach including implementing multi-factor authentication and providing additional HIPAA training to its work force members.