Torrance Memorial Medical Center

The covered entity (CE) reported that two workforce members responded to a phishing email which resulted in a breach of protected health information (PHI). The breach affected 44,960 individuals and included names, addresses, dates of birth, health care claims information, diagnoses, medications, other treatment information, and 3,304 social security numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE took a number of steps to strengthen its administrative and technical safeguards. It increased its security training and enhanced authentication procedures and technical measures to identify and remove malicious emails. OCR’s investigation resulted in the CE improving its practices in safeguarding PHI.