Valley View Hospital Association

The covered entity (CE), Valley View Hospital Association, reported that multiple employees were victims of an email phishing attack affecting the protected health information (PHI) of 21,826 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, drivers’ license numbers, claims and financial information, diagnoses, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, the CE implemented additional technical safeguards and offered complementary identity theft protection and credit monitoring services to affected individuals. OCR provided the CE with technical assistance regarding the HIPAA Security Rule’s risk analysis and risk management requirements.