An unauthorized party accessed a workforce member’s email account containing the protected health information (PHI) of 662 individuals, including demographic, clinical, and health plan information. The CE provided breach notification to HHS, affected individuals, and the media, and provided substitute notice. Following the breach, the CE strengthened safeguards by implementing multi-factor authentication for its email account, applying a mandatory password change for all users, and increasing the required frequency of workforce member password changes. The CE also trained workforce members to identify phishing attempts. OCR obtained evidence of safeguards implemented prior to the breach and assurances that the CE implemented the corrective action steps listed above.
