Lexology May 2, 2025
On April 23, 2025, the Department of Health and Human Services’ Office for Civil Rights (“OCR”) announced a HIPAA enforcement action against PIH Health, Inc. (“PIH”), a California-based health care network, following a phishing attack that exposed patients’ electronic protected health information (“ePHI”). The settlement highlights OCR’s continued focus on ensuring that covered entities implement robust security programs capable of identifying and mitigating threats to ePHI.
The investigation stemmed from a breach report submitted by PIH in January 2020, which disclosed that in June 2019, a phishing attack had compromised the email accounts of 45 employees. The attack resulted in the unauthorized disclosure of unsecured ePHI belonging to 189,763 individuals, including names, addresses, dates of birth, driver’s license numbers, Social...
Today's Sponsors
Today's Sponsor