SAG-AFTRA Health Plan

The covered entity (CE), SAG-AFTRA Health Plan, reported that an employee was the target of an email phishing scheme that affected the electronic protected health information (ePHI) of 98,474 individuals. The ePHI involved included names, social security numbers, and claims information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative, technical, and security safeguards. Staff were also retrained in its requirements to protect and secure PHI. OCR provided technical assistance to the CE regarding the HIPAA Security Rule.