Episcopal Health Services

The covered entity (CE), Episcopal Health Services, Inc., reported that numerous employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 218,055 individuals. The ePHI involved included names, dates of birth, addresses, Social Security numbers, drivers’ license numbers, financial information, diagnoses, mediations prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and provided free credit monitoring services to affected individuals. In its mitigation efforts, the CE implemented new administrative and technical safeguards to better protect its sensitive data. OCR obtained assurances that the CE implemented the corrective actions noted.