HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Children’s Hospital Colorado Suffers Phishing Attack

Children’s Hospital Colorado is notifying 2,553 patients that some of their protected health information was stored in an email account that was accessed by an unauthorized individual between April 6-12, 2020.

Credentials to access the account were obtained when an employee responded to a phishing email. The phishing attack was identified by the hospital on June 22, 2020 and the account was immediately secured. A review of the emails and email attachments in the account revealed they contained patient names, zip codes, dates of service, medical record numbers, and clinical diagnosis information.

Steps have since been taken to harden email security defenses, platforms are being evaluated for educating staff on cybersecurity, and technical controls related to email are also being reviewed.

Stolen Hoag Clinic Laptop Contained Unencrypted PHI

On June 5, 2020, a laptop computer issued to an employee of the Hoag Clinic in Costa Mesa, CA was stolen from a vehicle parked in the worksite parking lot in Newport Beach. The theft was discovered the same day and law enforcement was notified, but the laptop computer has not been recovered.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The IT security team determined the laptop contained the protected health information of 738 individuals, including first and last names, middle initial, address, phone number, date of birth, age, medical record number, e-mail address, physician name, whether the patient is being followed by case management, if a COVID-19 test has been conducted, if the individual had been transferred to case management, if a telehealth visit had been scheduled, communication status notes, and if the individual was interested in home health.

The Hoag clinic has re-educated the workforce on security safeguards, enhanced policies covering the transportation of laptop computers between worksites, and a thorough security assessment has been conducted to ensure all appropriate cybersecurity safeguards are in place. Affected individuals have been offered complimentary membership to the Experian IdentityWorks identity theft detection and resolution service for 12 months.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.