Community Memorial Health System

On June 22, 2017, several hundred staff members at Community Memorial Health System, the covered entity (CE), received phishing emails. One employee working remotely followed the link, compromising her account. The CE provided breach notification to HHS, affected individuals, and the media. The CE took steps to limit unauthorized access to its systems, including disabling external and mobile device access, requiring all users to reset their account credentials, and requiring two-factor verification for access. Since the incident, the CE sanctioned the responsible workforce member, improved technical safeguards, and deployed a software solution for centralized monitoring of server logging data in order to more quickly identify a breach. OCR obtained assurances that the CE implemented the corrective actions noted here.