Georgia Department of Human Services

The covered entity (CE), Georgia Department of Human Services, reported that several employees of its business associate (BA) were victims of an email phishing attack that affected the electronic protected health information (ePHI) of 45,732 individuals. The ePHI involved included names, email addresses, phone numbers, addresses, dates of birth, Social Security numbers, claims and financial information, diagnoses/conditions, lab results, medications prescribed, and health insurance information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, the BA retrained its employees on the proper methods of identifying fraudulent email communications and implemented additional technical safeguards. OCR provided technical assistance pertaining to the HIPAA Privacy and Breach Notification Rules.