The covered entity (CE), St. Louis University, reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of approximately 800 individuals. The ePHI involved included names, diagnoses, and clinical and treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI. The CE trained all employees on the new or revised policies and procedures and implemented monthly security awareness training. OCR provided technical assistance to the CE regarding the HIPAA Security Rule.
