Reliable Respiratory

On July 2, 2018, the covered entity (CE), Reliable Respiratory, learned that a phishing email sent on June 28, 2018, comprised an employee’s email, potentially exposing the protected health information (PHI) of approximately 21,311 individuals. The types of PHI involved in the incident included demographic, clinical, and financial information. The CE provided breach notification to HHS, affected individuals, and the media, provided a call-center number and provided free credit monitoring. OCR obtained assurances that the CE implemented the corrective actions listed above. As a result of OCR’s investigation, the CE is working to implement additional safeguards such as email encryption solutions, more stringent inbound email filters targeted at catching and quarantining suspicious emails, and multifactor authentication.