The covered entity (CE), Washington University School of Medicine, reported that numerous employees were victims of an email phishing attack. This breach affected 80,270 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, Social Security numbers, financial information, and treatment information. The CE notified HHS, affected individuals, and the media. The CE implemented additional administrative and technical safeguards to further protect its PHI and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.
