Wyoming Medical Center

On February 25, 2016, Wyoming Medical Center, the covered entity (CE), discovered that a hacker compromised two employees’ email accounts after the employees succumbed to the hacker’s phishing emails. The breach allowed the hacker access to 3,184 individuals’ electronic protected health information (ePHI), including names, medical record numbers, account numbers, dates of hospital service, dates of birth, and other medical information. Following the breach and as a result of OCR’s investigation, the CE notified affected individuals and the media of the breach, changed email passwords, scanned its systems confirming the absence of malware, and provided its employees additional training specifically designed to address phishing awareness. OCR also provided the CE with technical assistance regarding its obligation to safeguard ePHI that is either transmitted over an electronic communications network (via email) or maintained (at rest) in an email server.