Palmetto Health

Palmetto Health, the covered entity (CE), reported that employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 23,811 individuals. The ePHI involved included names, addresses, birthdates, claims information, diagnoses, lab results, medications prescribed, Social Security numbers, and treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI. The CE retrained its staff on the proper methods of identifying fraudulent email communications. OCR conducted an outreach presentation on the HIPAA Privacy, Security, and Breach Notification Rules and obtained assurances that the CE implemented the corrective actions noted.