HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

23,300 Patients Affected by Critical Care, Pulmonary & Sleep Associates Email Hack

Critical Care, Pulmonary & Sleep Associates (CCPSA) in Colorado has experienced a data breach that has impacted more than 23,300 patients.

An email account breach was detected by CCPSA on November 23, 2018 when suspicious activity was detected related to an employee’s email account. The account appeared to have been used to send phishing emails to individuals in the employee’s contact list. Those emails attempted to convince the recipients to make fraudulent payments.

Action was promptly taken to lock the hacker out of the account and the entire email environment was secured. All users were required to set new, complex passwords. A third-party computer forensics firm was hired to investigate the attack and determine the scale of the breach. That investigation was concluded on December 14, 2018.

The investigation revealed the attacker had gained access to multiple email accounts between August 14 and November 23, 2018. The breach was determined to be limited to the email system. Its medical record system was unaffected.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

An analysis of the compromised email accounts revealed they contained the electronic protected health information of more than 23,300 patients. In addition to patients’ names, the following information was also potentially compromised: Addresses, email addresses, phone numbers, dates of birth, dates of service, diagnoses, medical conditions, lab test results, information related to diagnostic studies, treatment information, insurance information, and for certain patients, costs of medical services, Social Security numbers, and driver’s license numbers.

Prior to the attack, CCPSA had implemented protections to prevent successful phishing attacks. Those protections have now been enhanced. Additionally, changes have been made to how authorized individuals can access the network and changes have also been made by the IT department to certain rules within its computer environment. Additional, mandatory security awareness training has also been provided to the entire workforce.

According to the breach summary posted on the Department of Health and Human Services’ Office for Civil Rights breach portal, the ePHI of 23,377 has been exposed.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.