HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 5, 2018.
- Organization as reported
- Diagnostic Radiology & Imaging, LLC, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 5, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13868, row:5007)
- Archived copy
- Held in the private archive (provenance)
On November 11, 2017, an unauthorized user accessed the email account of a Diagnostic Radiology & Imaging employee via a successful phishing attack. The breach affected the protected health information (PHI) of 799 individuals and included names, email addresses, phone numbers, dates of birth, descriptions of imaging services provided, medical record numbers, and patients’ comments. The covered entity (CE) provided breach notification to HHS, affected individuals, the media, and on its website. In response to the breach and OCR’s investigation, the CE disabled the affected email account, required its employees to complete additional cybersecurity training, and provided additional education to employees on how to identify phishing attempts. The CE’s chief operation officer began meeting with employees bi-weekly to discuss security issues. The CE started issuing a weekly newsletter regarding phishing attacks and it implemented multi-factor authentication for all email account holders. OCR obtained assurances that the CE implemented the corrective actions listed above.