Verity Medical Foundation

An unauthorized third party accessed a workforce member’s email account, affecting the protected health information (PHI) of 14,894 individuals, including demographic, clinical, health plan claims, and payment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE strengthened safeguards by adding technical measures to protect against phishing and malicious email and trained workforce members to identify phishing attempts. OCR obtained evidence of the safeguards that the CE implemented prior to the breach and documented assurances that the CE implemented the voluntary corrective action steps noted above.