Healthgrades Operating Company, Inc.

The business associate (BA), Healthgrades Operating Company, reported that an employee was the victim of an email phishing attack that affected the electronic protected health information (ePHI) of 35,485 individuals. The ePHI involved included names, addresses, dates of birth, Social Security numbers, clinical information, and health insurance information. The BA notified HHS and the covered entity notified affected individuals and the media. In response to the breach, the BA implemented a new email and security awareness program, implemented additional technical safeguards, and sanctioned and retrained the employee responsible for the breach.