Vail Health Services

The covered entity (CE), Vail Health Services, reported that multiple employees were victims of an email phishing attack affecting the protected health information (PHI) of 41,889 individuals. The PHI involved included names, dates of birth, addresses, diagnoses, passport numbers, health insurance information, drivers’ license numbers, Social Security numbers, and clinical information. The CE notified HHS, affected individuals, the media, and provided substitute notification. In response to the breach, the CE retrained its staff on email security and implemented additional technical safeguards. OCR provided technical assistance to the CE regarding its HIPAA Privacy Rule and Security Rule obligations.