National DCP Health Plan

In March 2017, an employee of the covered entity (CE), National DCP Health Plan, followed a link included in a phishing email, and as a result, an unauthorized user accessed her email account. The types of protected health information (PHI) involved in the breach consisted of health plan enrollment data, including names, addresses, social security numbers, and dates of birth for 1,190 individuals. The CE provided breach notification to HHS, affected individuals, and on its website. It also reported the incident to the FBI and the Secret Service. In response to the incident and OCR’s investigation, the CE implemented multi-factor authentication for access to its email systems, improved safeguards for inbound email, and required several additional training sessions for its workforce, including training and testing for recognizing phishing email scams. OCR obtained assurances that the CE implemented the corrective actions listed above.