The Boston-based integrated health delivery network notified 3,300 individuals that their protected health information may have been compromised by a phishing attack. A group of its workforce members had received phishing emails. They provided information in response to the email, believing the messages were legitimate. Some of the emails contained patient demographic information, such as names, addresses, dates of birth, and telephone numbers. Social Security numbers, and clinical information, such as diagnosis, treatment received, medical record numbers, medical diagnosis codes, or health insurance information were also compromised. The organization's electronic health records system was not compromised by the attack.