1,080 Chaplaincy Health Care Patients Potentially Impacted by Phishing Attack
Chaplaincy Health Care, a not-for-profit healthcare provider based in Richland, WA, has experienced a phishing attack that has resulted in the exposure of 1,080 patients’ protected health information.
The phishing attack occurred on November 20, 2018 and was discovered within 4 hours. Prompt action was taken to block unauthorized access and a third-party computer forensics firm was hired to assist with the breach investigation.
The investigation confirmed that a single email account was accessed by the attacker. After gaining access to the email account, the attacker attempted to access further accounts. The breach was discovered when the employee was alerted that her account had been used to send a phishing email to an email contact.
No evidence was uncovered to suggest any patient health information was viewed or copied but, out of an abundance of caution, all patients affected by the breach have been offered complimentary credit monitoring and identity theft protection services through LifeLock for 12 months. Patients were notified about the breach on January 3, 2019.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The firm investigating the breach concluded that the primary aim of the attack was to compromise as many email accounts as possible rather than to access sensitive information, although it was not possible to determine whether any emails in the compromised account had been accessed.
The compromised email account contained full names, home addresses, dates of birth, medical record numbers, prescription information, dates of service, and the last four digits of Social Security numbers.
“Chaplaincy Health Care sincerely apologizes for the inconvenience and the concern this incident has caused,” explained Gary Castillo, Executive Director of Chaplaincy Health Care. “Information security is very important to us and we will continue to do everything we can to fortify our operational protections for our patients and their families.”
In response to the breach, Chaplaincy Health Care has implemented two-factor authentication on its email accounts and employees have been provided with further training on protecting sensitive patient information.
