Northwestern Health Sciences University

The covered entity (CE), Northwestern Health Sciences University (NHSU), reported that several employees were the victims of an email phishing attack. This breach affected 1,198 individuals and the protected health information (PHI) involved included names, Social Security numbers, drivers’ license numbers, passport information, diagnostic information, treatment information, medications prescribed, and health insurance information. The CE notified HHS, affected individuals, the media, and offered complimentary credit monitoring and identity theft services to all affected individuals. In addition, the CE implemented additional administrative, technical, and security safeguards and retrained its staff on the proper methods of identifying fraudulent email communications. OCR obtained assurances that the CE implemented the corrective actions noted.