UHS of Delaware, Inc.

UHS of Delaware, the business associate (BA), reported that an employee of its subcontractor was the subject of an email phishing scheme that compromised the protected health information (PHI) for 40,290 individuals. The PHI involved included names, addresses, dates of birth, claims and health insurance information, diagnoses, and other treatment information. The BA notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the BA implemented additional administrative, technical, and security safeguards to better protect its sensitive data. All staff were retrained on email security precautions.