InterAct of Michigan, Inc.

The covered entity (CE), InterAct of Michigan, Inc., reported that an employee was the victim of a phishing attack and an unauthorized individual gained access to the employee’s email account. The email account contained protected health information (PHI), including the names, addresses, dates of birth, treatment history, prescription information, and in some instances, social security numbers, of 1,290 individuals. The CE provided breach notification to HHS, the media, and the affected individuals. As part of the notification, the CE established a toll-free response line and provided twelve months of complimentary credit monitoring to individuals whose social security numbers were compromised. Following the breach, the CE changed the compromised employee’s account credentials, removed the email forwarding rule, and disabled forwarding to any external email addresses. In addition, the CE began reviewing logs on a weekly basis to better identity suspicious activity and turned off email web access for all users. The CE also installed new antivirus and phishing education software and retrained all workforce members on the importance of being vigilant when reviewing email. OCR obtained documentation that the CE implemented the corrective actions listed above.