The covered entity (CE), Wisconsin Department of Health Services, reported that its business associate (BA) experienced a cyberattack that compromised the protected health information (PHI) of 19,150 individuals. The PHI involved included names, dates of birth, social security numbers, diagnoses/conditions, and other treatment information. The CE notified HHS and the media; the BA notified the affected individuals. In its mitigation efforts, the CE provided credit monitoring and established a call center for questions and concerns. The BA implemented additional administrative and technical safeguards to better protect sensitive data.
