Synergy Specialists Medical Group, Inc / Jay S. Berenter, DPM

An employee of the covered entity (CE), Synergy Specialists Medical Group/Jay S. Berenter, opened a phishing email that caused patients to receive false emails from the CE. The breach of the email account affected 569 individuals. Of the 569 individuals, the CE impermissibly disclosed a subset of 71 patient names and email addresses when it failed to blind copy those names and email addresses when notifying the patients of the fraudulent email. The types of protected health information (PHI) involved included names, addresses, email addresses, dates of birth, treatment information, diagnoses, and medications. The CE took immediate action to secure its email account and began a forensic investigation to determine the cause and extent of the incident. The CE implemented additional technical safeguards, revised policies, and trained workforce members to improve its security prevention and detection practices. OCR obtained assurances that the CE implemented the corrective actions noted above.