Grand River Medical Group

Grand River Medical Group, the covered entity (CE), reported that an employee was the victim of an email phishing attack that compromised the protected health information (PHI) of 37,423 individuals. The PHI involved included names, addresses, Social Security numbers, dates of birth, claims information, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and provided complimentary credit monitoring services. In response to the breach, the CE strengthened its technical safeguards and retrained its staff on email security. OCR provided the CE with technical assistance regarding its HIPAA Security Rule obligations.