District Medical Group

District Medical Group, the covered entity (CE), reported that several employees were the victims of an email phishing scheme that affected the electronic protected health information (ePHI) of 10,190 individuals. The ePHI involved included names, Social Security numbers, medical records numbers, health insurance information, and limited clinical information. The CE notified HHS, affected individuals, the media, and offered complimentary credit monitoring services to all affected individuals. In its mitigation efforts, the CE retrained its workforce on the proper methods of identifying and responding to fraudulent email communications. The CE also implemented additional technical and security safeguards.