Huggins Insurance Services, Inc.

The business associate (BA), Huggins Insurance Services, reported that several employees were the victims of an email phishing scheme which affected the electronic protected health information (ePHI) of 5,725 individuals. The ePHI involved included names, addresses, dates of birth, drivers’ license information, Social Security numbers, claims information, financial data, and clinical information. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA implemented additional administrative, technical, and security safeguards and retrained its staff on the proper methods for identifying fraudulent email communications. OCR provided technical assistance to the BA regarding the provisions of the HIPAA Security Rule.