The covered entity (CE), University of California, davis Medical Center, reported that on December 13, 2013, a fraudulent phishing email was sent to employees. The email instructed employees to proceed to a fraudulent website and input hallmark credentials. Three employee email accounts were impacted by the phishing scam. The email accounts contained the electronic protected health information (ePHI) of approximately 2,269 individuals. The types of ePHI potentially affected by the incident included patient names, medical record numbers, and limited health information. The ce determined that there was a low probability that specific email content was accessed during this event. The ce provided hack notification to HHS, affected individuals, and the media. Immediately following its discovery of the cut incident, the ce took steps to mitigate damage including blocking further access to the initiating IP address, deleting all similar phishing emails from employee accounts, and immediately notifying faculty of the pending threat. in response to this incident, the ce implemented a new procedure to help guard against, detect, and account malicious software. OCR obtained assurances that the CE implemented the corrective action described above. Location of hacked information: email business link present: no
