OCR Issues Alert Regarding Phishing Email Disguised As Official OCR Audit Communication

11/30/2016 Update: Today OCR issued another alert relating to the phishing email campaign and has shared that the phishing email originates from the email address [email protected] and directs individuals to a URL at http://www.hhs-gov.us. This is a subtle difference from the official email address for OCR's HIPAA audit program, [email protected]. Covered entities and business associates should alert their workforce members of this issue and take note that official communications regarding the HIPAA audit program are sent to selected auditees from the email address [email protected].

— 11/29/2016

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published an alert on Nov. 28 describing a phishing email being circulated on mock HHS departmental letterhead under the signature of OCR Director Jocelyn Samuels. The email prompts recipients to click a link regarding possible inclusion in the HIPAA Privacy, Security, and Breach