White Coats Wellness

On May 8, 2017, an employee responded to a phishing email, compromising the electronic protected health information (ePHI) (specifically, demographic information) of approximately 15,000 individuals. White Coats Wellness, which is a business associate (BA), notified the relevant covered entities about the breach. In response to the incident, the BA investigated the incident, reset employees’ account passwords, updated its malware detection system, implemented a new policy that requires a periodic review and cleanup of old data, and retrained staff on how to identify phishing schemes. As a result of OCR’s investigation, the BA conducted a new risk analysis and risk management plan. OCR obtained assurances that the BA implemented the corrective actions listed above.