Saint Agnes Health Care, Inc.

An unauthorized user gained access to employees' email accounts due to a phishing attack. The breach included the protected health information (PHI of approximately 25,000 individuals and included demographic, financial, and clinical information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE provided additional staff training regarding phishing attacks and implemented additional safeguards for its email system to prevent phishing attacks. OCR reviewed the CE's risk analysis and ensured it took appropriate steps to implement its risk management plan.