Chapman & Chapman, Inc.

Chapman & Chapman, a business associate (BA), reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of 2,545 individuals. The ePHI involved included names, birthdates, Social Security numbers, health insurance information, treatment information, and diagnoses/conditions. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA implemented additional administrative and technical safeguards and retrained its staff. OCR obtained assurances that the BA implemented the corrective actions noted.