1,600 Patients Potentially Impacted by Terros Health Phishing Attack
An employee of Phoenix-based Terros Health was fooled by a phishing scam and inadvertently handed over login credentials to the attacker. That individual accessed the employee’s email account and potentially viewed or obtained a range of protected health information (PHI) detailed in individual emails in the account. The breach was limited to one email account and access to other systems was not gained.
Terros Health learned of the phishing attack on April 12, 2018 and notified the media on June 8. All patients impacted by the breach have now been notified by mail.
An investigation into the attack revealed the employee responded to the phishing email on or around November 16, 2017, which was when the email account was first accessed by the attacker.
While almost 1,600 patients potentially had some of their PHI compromised as a result of the attack, for the majority of patients (1,241) the exposed information was limited to names and dates of birth. The remaining patients also had their addresses, email addresses, diagnoses, medical record numbers, and other protected health information exposed. 142 patients’ Social Security numbers were also present in the compromised email account and could potentially have been viewed or obtained. The majority of patients affected by the breach had previously received medical services at its 23rd/Dunlap Avenue clinic.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Prior to the attack, Terros Health had implemented safeguards to prevent the unauthorized accessing of PHI, although the phishing attack bypassed those controls. Further steps have now been taken to improve security, policies and procedures have been enhanced, and additional security awareness HIPAA training is being provided to staff.
Patients whose Social Security number was exposed have been offered credit monitoring and identity theft protection services for 12 months without charge.
