Rainbow Rehabilitation Centers

The covered entity (CE), Rainbow Rehabilitation Centers, reported that an employee was the victim of an email phishing attack that compromised the protected health information (PHI) of 1,639 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, Social Security numbers, and health insurance information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE provided complimentary credit monitoring services to those affected and implemented additional administrative and technical safeguards to better protect its PHI. Workforce members were retrained on email security. OCR provided the CE with technical assistance regarding the HIPAA Privacy and Security Rules.