Unum Group

The covered entity (CE), Unum Group, reported that an employee was the victim of an email phishing scheme. The protected health information (PHI) involved included names, addresses, dates of birth, Social Security numbers, health diagnoses, and employer information. This breach affected 532 individuals. The CE retained legal counsel and hired forensic investigators to assist with the investigation. The CE provided breach notification to HHS and affected individuals. In addition, Unum deleted the phishing email from mailboxes, forced password resets, updated and completed a risk analysis, implemented multi-factor authentication, reduced email retention, blocked suspicious websites, and provided supplemental HIPAA training to its workforce. OCR provided the CE with technical assistance regarding timely breach notification. OCR obtained assurances that the CE met its notification requirements and implemented the corrective actions noted above.