University of Chicago Medical Center

The covered entity (CE), University of Chicago Medical Center, reported that several employees were the subjects of an email phishing scheme that compromised the protected health information (PHI) of approximately 2,568 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and social security numbers, health insurance information, diagnoses and conditions, lab results, and medications. The CE notified HHS, the affected individuals, and the media. The CE ’s mitigation efforts included strengthening its administrative, technical, and security safeguards.