Inogen, Inc.

On April 17, 2018, Inogen, Inc., the covered entity (CE), reported that an unauthorized individual hacked data from its systems by gaining access to an email account belonging to an employee and setting up forwarding of email messages to an unknown, external email address from January 2, 2018 until March 14, 2018. The breach affected approximately 29,000 individuals and the types of protected health information (PHI) compromised included names, addresses, telephone numbers, dates of birth, dates of death, Medicare identification numbers, insurance policy information, and medical equipment provided. The CE provided breach notification to affected individuals, the media, and HHS. As a result of this incident, the CE strengthened its security controls, such as disabling the ability of email users to set forwarding rules, requiring all email users and administrators to change their passwords, and implementing dual-factor authentication for remote email access. OCR obtained assurances that the CE implemented the corrective action steps noted above.