Nearly 200,000 Patients Impacted by PIH Health Phishing Attack
PIH Health, a 2-hospital nonprofit healthcare network based in Whittier, CA, has started notifying nearly 200,000 patients about a potential breach of their personal and protected health information in June 2019.
On June 18, 2019, PIH Health discovered the email accounts of certain employees had been accessed by unauthorized individuals as a result of a targeted phishing attack on its employees. The email accounts were immediately secured and an investigation was launched to determine the nature and extent of the breach.
PIH Health engaged leading cybersecurity experts to assist with the investigation and was notified on October 2, 2019, that the email accounts were subject to unauthorized access between June 11, 2019 and June 18, 2019.
The email accounts were then reviewed by the same cybersecurity experts to determine whether they contained any patient information. The review was completed on November 12, 2019. PIH Health then attempted to obtain up to date contact information for current and former patients affected by the breach. Notifications were sent by mail to those individuals on January 10, 2020.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The phishing attack has been reported to the Department of Health and Human Services Office for Civil Rights. The summary on the OCR breach portal indicates up to 199,548 patients were potentially affected by the attack.
Patients have been advised to monitor their account statements and to report any suspected fraudulent account activity. Patients have also been offered complimentary credit monitoring and identity theft protection services through Kroll for 12 months.
“The privacy and protection of private information is a top priority for PIH Health,” wrote PIH Health in its substitute breach notification. “PIH Health deeply regrets any inconvenience or concern this incident may cause.”
