Progressions Behavioral Health Services, Inc.

An unauthorized user gained access to employees’ email account after a phishing attack and set the employees’ emails to automatically forward to an external account. The breach involved the protected health information (PHI) of 1,303 individuals and included clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented multi-factor authentication for its email accounts and implemented a new privacy and security training program for employees. Additionally, OCR ensured that the CE completed an appropriate risk analysis after the breach.