Terros Incorporated

The covered entity (CE) discovered that as a result of a phishing email an employee’s email account was set to forward all the employee’s emails to a rogue external email address and delete certain emails. This incident compromised the protected health information (PHI) of 1,618 individuals, including clinical, demographic, and financial information. The CE provided breach notification to HHS, affected individuals, and the media. To prevent a similar breach from happening in the future, the CE instituted new technical safeguards in the form of multi-factor account authentication and stricter measures for its email and mailbox protocols and trained staff. Following OCR’s investigation, the CE also updated its policies and procedures.