Wayne County Hospital

The covered entity (CE), Wayne County Hospital, reported that several employees were subjected to an email phishing scheme that affected the protected health information (PHI) of 2,016 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, claims and financial information, diagnoses, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE offered complimentary credit monitoring services and sanctioned the employees who fell victim to the phishing attack. The CE also strengthen its administrative and technical safeguards to better protect PHI. Staff were retrained on email security.