UC Davis Medical Center, Privacy Manager Breach

The covered entity (CE), University of California, Davis Medical Center, reported that on December 13, 2013, a fraudulent phishing email was sent to employees. The email instructed employees to go to a fraudulent website and input authentication credentials. Three employee email accounts were impacted by the phishing scam. The email accounts contained the electronic protected health information (ePHI) of approximately 2,269 individuals. The types of ePHI potentially affected by the incident included patient names, medical record numbers, and limited health information. The CE determined that there was a low probability that specific email content was accessed during this event. The CE provided breach notification to HHS, affected individuals, and the media. Immediately following its discovery of the breach incident, the CE took steps to mitigate harm including blocking further access to the initiating IP address, deleting all similar phishing emails from employee accounts, and immediately notifying staff of the pending threat. In response to this incident, the CE implemented a new procedure to help guard against, detect, and report malicious software. OCR obtained assurances that the CE implemented the corrective action described above.