The Devereux Foundation

• •Isolated its systems
• •Assessed the security of its network
• •Launched an investigation to determine the nature and scope of the event
• •Engaged third-party specialists to assist in ensuring the security and operations of its systems and investigating the nature and scope of the activity
• •Notified federal law enforcement regarding the event and is cooperating with the investigation
• •Providing access to credit monitoring services for twelve (12) months, through Experian, to individuals whose personal information was involved in this incident, at no cost to these individuals
• •Providing impacted individuals with guidance on how to better protect against identity theft and fraud
• •Providing written notice of this incident to relevant state and federal regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
• •Notifying the U.S. Department of Health and Human Services, and prominent media pursuant to the Health Insurance Portability and Accountability Act (HIPAA)

• •Working to augment their policies and procedures
• •Providing additional training to its employees
• •Implementing additional training for employees to reduce the likelihood of a similar event from occurring in the future

DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).