HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Confluence Health Informs Patients of Phishing Incident

Confluence Health, a not-for-profit health system that operates Central Washington Hospital, Wenatchee Valley Hospital and a dozen satellite clinics in Central and North Central Washington, has experienced a data security incident involving an employee’s email account that may have resulted in unauthorized accessing of patients’ protected health information.

The security breach was discovered on May 29, 2018. A digital forensics firm was called in to conduct an investigation, which revealed the email account had been accessed by an unauthorized individual on May 28 and May 30, 2018.

The email account only contained a limited amount of protected health information and no highly sensitive data such as Social Security numbers or financial information was exposed. Patients impacted by the incident have had information such as their names and treatment information exposed.

Confluence Health had multiple security solutions in place to prevent unauthorized account access and staff had received security awareness training, yet those measures were bypassed by the attacker.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

While PHI access was possible, the investigation uncovered no evidence to suggest that PHI had been stolen and no reports have been received by Confluence Health to suggest there has been any misuse of PHI.

Patients affected by the breach have been notified by mail and additional safeguards have now been implemented to improve the security of its email system and ensure that any suspicious email and network activity is detected more rapidly in the future.

The breach had been reported to the Department of Health and Human Services Office for Civil Rights. The breach summary indicates 33,821 patients were affected.

The incident is the latest in a spate of phishing attacks on healthcare organizations. In the past two months, phishing incidents have been reported by Sunspire Health in New Jersey, The Alive Hospice in Tennessee, the Terteling Co., Inc., Group Benefit Plan in Idaho, and Boys Town National Research Hospital. The latter incident was the eighth largest breach of 2018 and the largest breach at a pediatric hospital. The incident impacted more than 105,300 patients.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.