Orthodontic Specialists of Green Bay

The covered entity (CE), Orthodontic Specialists of Green Bay, reported a breach based on unauthorized access to one of its doctor’s email accounts that occurred between April 7, 2017 and April 10, 2017. An unauthorized individual(s) accessed a doctor’s email account at to monitor communications and receive financial gain by posing as the doctor and requesting the controller send funds to various accounts. The breached email account contained electronic protected health information (ePHI) for 742 affected individuals and included names and treatment information. Immediately following the breach, the CE contacted the Federal Bureau of Investigation (FBI) and which initiated an investigation. The covered entity provided breach notification to HHS, affected individuals, and the media. The CE directed its IT contractor to investigate the severity of the breach, and the investigation concluded that only one doctor’s email account was breached. The CE required all employees to change their passwords and created new password management policies. OCR obtained assurances that the CE implemented the corrective actions noted above.