880 Patients Potentially Impacted by Baptist Health Louisville Phishing Attack
Baptist Health in Louisville, KY has notified 880 patients that some of their protected health information has potentially been accessed and stolen by hackers.
The security breach was discovered on October 3, 2017, when irregular activity was detected on the email account of an employee. Baptist Health was able to determine that a third party sent a phishing email to the employee, who responded and disclosed login credentials allowing the email account to be accessed.
Those login credentials were subsequently used by an unknown individual to gain access the email account. The email account contained the protected health information of 880 patients, although it is unclear whether any of the emails were viewed. The motive behind the attack may not have been to gain access to sensitive information.
What is known, is access was used to send further phishing emails to other email accounts. Following the discovery of the breach, Baptist Health responded quickly to limit the potential for harm and disabled the affected email accounts and performed a password reset to prevent further unauthorized access.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Due to the actions taken by the hacker once access to the account was gained, Baptist Health does not believe any information contained in the emails has been used inappropriately.
A review of all emails in the account showed the types of information potentially compromised included names, medical record numbers, dates of birth, clinical information, and treatment information. A limited number of Social Security numbers were also exposed.
Since the possibility of PHI access and misuse cannot be ruled out with a high degree of certainty, all 880 patients impacted by the breach have been notified and patients whose Social Security numbers were exposed have been offered complimentary credit monitoring and identity theft protection services for one year without charge.
Staff have also received additional training in relation to phishing emails, and the login process for remote access has been strengthened to prevent similar breaches from occurring in the future.
