EmCare, Inc.

The covered entity (CE), EmCare, Inc., reported that numerous employees fell victim to an email phishing scheme affecting the protected health information (PHI) of 31,934 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, Social Security numbers, treatment information and financial data. As a result of this breach, the CE implemented additional administrative and technical safeguards to better protect its data. It also retrained its staff on the proper methods of identifying fraudulent email communications. EmCare notified HHS, affected individuals, the media, and posted substitute notice on its website. OCR provided the CE with technical assistance regarding the detection of breach incidents and timely breach notification. OCR obtained assurances that the CE implemented the corrective actions noted.