Authentic Recovery Center, LLC

A hacker gained unauthorized access to a workforce member’s email account via a phishing email. The email account contained the protected health information (PHI) of 1,790 individuals and included demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE performed a risk analysis, enhanced its spam email filtering, and implemented audit logs and alerts for suspicious activity on its electronic network. OCR’s investigation resulted in the CE enhancing its practices for safeguarding PHI.