Utah Pathology Services

The covered entity (CE), Utah Pathology Services, Inc., reported that multiple employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 148,594 individuals. The ePHI involved included names, dates of birth, gender, telephone numbers, addresses, health insurance information, clinical and diagnostic information, and Social Security numbers. The CE notified HHS, affected individuals, the media, and provided complimentary credit monitoring and identity restoration services. In response to the breach, the CE implemented additional administrative and technical safeguards to better protect its ePHI. OCR provided the CE with technical assistance regarding the Security Rule and its requirements.