BayState Health Discovers 13,000 Patients Impacted by Phishing Attack
Springfield-MA-based Baystate Health has announced that five employees have fallen victim to a phishing scam that has potentially resulted in the exposure of the protected health information of as many as 13,000 patients.
Scam emails were sent to a number of Baystate Health employees in August this year. The emails were well-written and realistic and appeared to have been sent internally from the human resources office. The emails appeared to have been sent to advise employees of some important changes to salaries and other important HR importation.
However, by following the instructions in the email to view the information, employees inadvertently gave the attackers access to their email accounts and also a Baystate Health database which contained sensitive patient data.
An investigation was launched into the phishing attack which revealed that names, demographic information, patient ID numbers, and dates of birth were all potentially been accessed by the attackers. Certain patients’ treatments and diagnoses were also exposed as a result of the scam. The investigation did not uncover any evidence to suggest that patient data had been viewed or copied, although the possibility could not be ruled out. Baystate Health confirmed that patients’ Social Security numbers, financial information, and medical charts were not compromised in the attack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Investigators concluded that had the Baystate Health database been opened by the attackers, it was closed rapidly when it was discovered there were no financial data or Social Security numbers present.
Patients have now been informed of the potential PHI breach by mail and have been advised to activate fraud alerts on their accounts and monitor their account statements for any sign of fraudulent activity. No reports have been received that any patients PHI has been abused.
Baystate Health has now secured its email system and is conducting further staff training to raise awareness of the risk of phishing attacks.
