Record details
- Classification
- enforcement
- Published date
- April 23, 2025
- Source
- HHS Office for Civil Rights
What this record says
OCR announced a settlement involving a regulated entity after a phishing attack breach investigation. The official release and linked resolution documents are the primary source for the facts and corrective obligations in that matter. The practical lesson is to connect phishing prevention and response to documented risk analysis, risk management, workforce practices, and incident handling rather than treating email security as an isolated control.
Who should review this
- Covered entities
- Business associates
- Security teams
Core concepts
- risk analysis
- risk management
- phishing
- incident response
References
- Primary source HHS Office for Civil Rights