University of Utah Health, the covered entity (CE), reported that multiple employees were the subjects of an email phishing scheme affecting the protected health information (PHI) of 18,317 individuals. The PHI involved included names, birthdates, lab results, medications, and diagnoses. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards.
