The covered entity (CE) reported that two workforce members responded to a phishing email which resulted in a breach of protected health information (PHI). The breach affected 44,960 individuals and included names, addresses, dates of birth, health care claims information, diagnoses, medications, other treatment information, and 3,304 social security numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE took a number of steps to strengthen its administrative and technical safeguards. It increased its security training and enhanced authentication procedures and technical measures to identify and remove malicious emails. OCR’s investigation resulted in the CE improving its practices in safeguarding PHI.
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","health"] · backfill source
2026-09-25 · records_basis: organization to hhs · backfill source
2026-09-25 · records: 32499 to 46632 · backfill source
2026-09-25 · summary: empty to The covered entity (CE) reported that two workforce members responded to a phishing email which resulted in a breach of protected health information (PHI). The breach affected 44,960 individuals and included names, addresses, dates of birth · backfill source
2026-09-25 · data_types: [] to ["names","ssn"] · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 32499 · backfill source
