Georgia Department of Community Health

Georgia Department of Public Health reported that an employee of its business associate was the target of an email phishing scheme that compromised the protected health information (PHI) of 532 individuals. The PHI included names, diagnoses and conditions, and other treatment information. The entity notified HHS, affected individuals, and the media, and OCR provided technical assistance.

Georgia Department of Community Health reported to HHS on 2015-03-02 a Hacking/IT Incident affecting 557,779 individuals. Breached information located on Network Server. Business Associate Anthem, Inc. experienced cyberattacks exposing ePHI including names, SSNs, medical IDs, addresses, DOBs, emails, and employment info.

Georgia Department of Community Health (a Health Plan) reported to HHS OCR on 2015-03-02 a Hacking/IT Incident affecting 355,127 individuals. AMGP Georgia Managed Care Company, a business associate, stored the CE's ePHI on servers of its parent, Anthem, Inc. Anthem suffered a series of cyberattacks exposing nearly 79 million people's ePHI. Exposed data included names, SSNs, medical ID numbers, addresses, dates of birth, email addresses, and employment information. OCR reviewed the BA agreement and separately reviewed Anthem, resulting in a monetary settlement and corrective action plan. Breached information located on Network Server.