City of Hope

City of Hope, the covered entity (CE), reported that a workforce member was a victim of an email phishing scheme. This breach affected 3,400 individuals. The protected health information (PHI) involved in the breach included names, addresses, dates of birth, social security numbers, diagnosis, lab results, medications, and other treatment information. Following the breach, the covered entity disabled remote access to its virtual private network, including email. Additionally, OCR’s investigation resulted in the covered entity improving their security safeguards and retraining employees.