Patients Notified of Burrell Behavioral Health Cyberattack and PHI Exposure
Springfield Missouri-based Burrell Behavioral Health has announced it has been the subject of a cyberattack which has potentially resulted in the protected health information of certain patients being obtained by unauthorized individuals.
The electronic medical record system was not accessed, although an unauthorized individual – or individuals – gained access to the organization’s email system between July 6 and July 7, 2016. The unauthorized access was identified on July 7 and counter measures were rapidly deployed to block access to the compromised account.
An internal investigation was launched and a leading cybersecurity company was contracted to conduct a thorough forensic investigation. The investigators were unable to establish whether the protected health information of patients was accessed, although it was not possible to rule out the possibility that PHI had been viewed or obtained in the attack. No reports of identity theft or other misuse of PHI have been received by Burrell Behavioral Health at this point in time.
An analysis of the emails stored I the account revealed that the following data elements could have been accessed: Names, dates of birth, addresses, Social Security numbers, physician’s names, diagnosis codes, health insurance numbers, disability codes, medical diagnoses, treatments provided, treatment locations, and medical record numbers. The information in the email account varied for each patient.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A substitute breach notice was uploaded to the organization’s website on September 2, 2016 and breach notification letters will be mailed to affected patients in the next few days. All individuals whose information was exposed will be offered credit monitoring and identity theft restoration services (with Kroll) for a period of 12 months without charge.
The incident has now appeared on the Department of Health and Human Services’ Office for Civil Rights breach portal. 7,748 individuals have been impacted by the breach.
