The Oregon Clinic, P.C. ("The Oregon Clinic")

On March 9, 2018, The Oregon Clinic, P.C. (OR) discovered that an unauthorized third party accessed an employee email account via a phishing attack, exposing ePHI (demographic and clinical information) of 64,487 individuals. Breached information located on Email. The CE notified HHS, affected individuals, and media, posted substitute notice, revised policies and procedures, and implemented MFA for its EHR system. OCR obtained assurances of corrective action.

Affected (this filing): 64,487