City of Hope

The covered entity (CE), City of Hope, received a phishing email on January 18, 2016, causing unauthorized access to several employee email accounts. The protected health information (PHI) involved in the breach included patients' names, medical record numbers, dates of birth, addresses, email addresses, telephone numbers, clinical information, test results, and dates of service and for one patient, the social security number and financial information. Approximately 1,024 individuals were affected by the breach. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice. Following the breach, the CE blocked access to a form in the embedded link contained in the phishing email, blocked the sender of the phishing email from sending additional emails, updated its spam filter, removed the email from the inboxes of users who received it, and sent an email to all staff to advise them of the issue. Additionally, the CE began updating its anti-phishing defenses and has upgraded its firewall. OCR provided the CE with technical assistance regarding the Security Rule including risk analysis and risk management.