The covered entity (CE), Sapphire Community Health, reported that its business associate (BA) experienced a cyber-attack on its network which contained the protected health information (PHI) of approximately 5,617 individuals. The PHI involved names, addresses, dates of birth, drivers’ license numbers, social security numbers, diagnoses/conditions, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. OCR provided technical assistance to the CE regarding the HIPAA Rules.
