Verity Health System of California, Inc.

An unauthorized third party accessed a workforce member’s email account, affecting the protected health information (PHI) of 2,988 individuals. The types of PHI involved in the breach included demographic, clinical, and financial information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE strengthened safeguards by training workforce members to identify phishing attempts, implementing multi-factor authentication for email, mandating changes to all users' passwords, and increasing the required frequency of workforce member password changes. OCR obtained evidence of the CE’s risk analysis and safeguards that it implemented prior to the breach.