The Seattle Indian Health Board

The Seattle Indian Health Board, the covered entity (CE), reported that on August 10, 2016, it experienced a cyber-security attack to an employee email account. CE determined that electronic Protected Health Information (ePHI) of approximately 793 individuals may have been affected by the breach. The ePHI affected by the breach included patients’ clinical, demographic, and financial information. As a result of discovering the breach, the CE notified affected parties and the media, provided retraining to the responsible workforce member, and provided additional training to other workforce members. The CE provided notification of the breach to the affected individuals via both U.S. Mail, and a message sent through its patient portal, as well as posting a notice about the breach on the homepage of its website. The CE took steps to prevent recurrence of the breach by implementing a company-wide password change and structured password management and control measures, including 90-day password “age” limits. In response to OCR’s investigation, the, the CE performed an updated Risk Analysis and drafted a corresponding risk management plan, updated relevant policies and procedures and implemented additional information security safeguards. OCR provided additional technical assistance to the CE concerning further periodic risk analyses and updating its risk management plan.