Children’s Hospital Colorado Suffers Phishing Attack
Children’s Hospital Colorado is notifying 2,553 patients that some of their protected health information was stored in an email account that was accessed by an unauthorized individual between April 6-12, 2020.
Credentials to access the account were obtained when an employee responded to a phishing email. The phishing attack was identified by the hospital on June 22, 2020 and the account was immediately secured. A review of the emails and email attachments in the account revealed they contained patient names, zip codes, dates of service, medical record numbers, and clinical diagnosis information.
Steps have since been taken to harden email security defenses, platforms are being evaluated for educating staff on cybersecurity, and technical controls related to email are also being reviewed.
Stolen Hoag Clinic Laptop Contained Unencrypted PHI
On June 5, 2020, a laptop computer issued to an employee of the Hoag Clinic in Costa Mesa, CA was stolen from a vehicle parked in the worksite parking lot in Newport Beach. The theft was discovered the same day and law enforcement was notified, but the laptop computer has not been recovered.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The IT security team determined the laptop contained the protected health information of 738 individuals, including first and last names, middle initial, address, phone number, date of birth, age, medical record number, e-mail address, physician name, whether the patient is being followed by case management, if a COVID-19 test has been conducted, if the individual had been transferred to case management, if a telehealth visit had been scheduled, communication status notes, and if the individual was interested in home health.
The Hoag clinic has re-educated the workforce on security safeguards, enhanced policies covering the transportation of laptop computers between worksites, and a thorough security assessment has been conducted to ensure all appropriate cybersecurity safeguards are in place. Affected individuals have been offered complimentary membership to the Experian IdentityWorks identity theft detection and resolution service for 12 months.
