Integrated Oncology Network

The Business Associate (BA), Integrated Oncology Network, reported that employees were the targets of an email phishing scheme that affected the PHI of 4,174 individuals. The PHI involved demographic, clinical, and treatment information. The BA notified the Covered Entities, HHS, the affected individuals, the media and posted substitute notice. In response to the breach, the BA ensured that no unauthorized mailbox rules, forwarding settings, or persistence mechanisms existed in the email tenant, initiated a global password reset for its email tenant, implemented multifactor authentication for all email accounts, verbally counseled affected employees, implemented workforce training and simulated phishing tests, and reevaluated its administrative, technical, and workforce training controls.