RiverMend Health, LLC

An employee’s email account was compromised as the result of a phishing email received on July 27, 2017, resulting in the receipt of suspicious emails soliciting fraudulent wire transactions on August 10, 2017. The incident exposed the protected health information (PHI) of 1,366 individuals, including demographic, clinical, claims, and billing information. The covered entity (CE) provided breach notification to HHS and affected individuals and posted substitute notice on its website. As a result of this incident, the CE reset all employee email passwords, terminated the email forwarding rule, and retained an outside company to conduct a forensic investigation. The outside company found no other unauthorized access to the CE’s computer system, network, or PHI. The CE also changed their information technology vendor to one with more secure practices. OCR obtained assurances that the CE implemented the corrective actions noted above.