Terteling Co., Inc., Group Benefit Plan

The covered entity (CE), a group health plan, reported to OCR that multiple employees responded to a phishing email which compromised the protected health information (PHI) of 4,824 plan members. The types of breached PHI included names, addresses, dates of birth, driver’s license information, social security numbers, claims information, diagnoses, and medications. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE strengthened its administrative and technical safeguards, such as authentication procedures and measures to identify and remove malicious emails. It also increased its security training. As a result of OCR’s investigation the CE enhanced its practices for safeguarding PHI.