Toyota Industries North America, Inc. as plan sponsor to the Toyota Industries North America, Inc. Welfare Benefit Plan

Toyota Industries North America, the covered entity (CE), reported that several employees were the victims of an email phishing attack. The breached accounts contained the protected health information (PHI) of 19,320 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license information, Social Security numbers, claims information, financial information, diagnoses/conditions, medications prescribed, and treatment information. The CE reported the breach to HHS, affected individuals, and the media. Following the breach, the CE immediately suspended the affected accounts and implemented additional technical safeguards and retrained its staff. As part of the training, the CE provided instruction on the HIPAA Privacy and Security Rules and on the proper methods for identifying fraudulent email communications. OCR obtained assurances that the CE implemented the corrective actions noted.