Community Psychiatric Clinic

The covered entity (CE), Community Psychiatric Clinic, reported that it was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of 5,866 individuals. The ePHI involved included names, Social Security numbers, addresses, birthdates, diagnoses/conditions, lab results, medications prescribed, claims information, and financial data. The CE notified HHS, affected individuals, and the media. After OCR’s investigation, the CE retrained its workforce members on the proper methods of identifying fraudulent email communications and implemented additional technical safeguards. OCR obtained assurances that the CE implemented the corrective actions noted.