The covered entity (CE), Summit Medical Group, reported that multiple employees were the targets of an email phishing scheme that compromised the protected health information (PHI) of 464,159 individuals. The PHI involved included clinical and demographic information. The CE notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the CE implemented additional administrative, technical, and security safeguards, and retrained workforce members to better protect PHI.
