Confluence Health Informs Patients of Phishing Incident
Confluence Health, a not-for-profit health system that operates Central Washington Hospital, Wenatchee Valley Hospital and a dozen satellite clinics in Central and North Central Washington, has experienced a data security incident involving an employee’s email account that may have resulted in unauthorized accessing of patients’ protected health information.
The security breach was discovered on May 29, 2018. A digital forensics firm was called in to conduct an investigation, which revealed the email account had been accessed by an unauthorized individual on May 28 and May 30, 2018.
The email account only contained a limited amount of protected health information and no highly sensitive data such as Social Security numbers or financial information was exposed. Patients impacted by the incident have had information such as their names and treatment information exposed.
Confluence Health had multiple security solutions in place to prevent unauthorized account access and staff had received security awareness training, yet those measures were bypassed by the attacker.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While PHI access was possible, the investigation uncovered no evidence to suggest that PHI had been stolen and no reports have been received by Confluence Health to suggest there has been any misuse of PHI.
Patients affected by the breach have been notified by mail and additional safeguards have now been implemented to improve the security of its email system and ensure that any suspicious email and network activity is detected more rapidly in the future.
The breach had been reported to the Department of Health and Human Services Office for Civil Rights. The breach summary indicates 33,821 patients were affected.
The incident is the latest in a spate of phishing attacks on healthcare organizations. In the past two months, phishing incidents have been reported by Sunspire Health in New Jersey, The Alive Hospice in Tennessee, the Terteling Co., Inc., Group Benefit Plan in Idaho, and Boys Town National Research Hospital. The latter incident was the eighth largest breach of 2018 and the largest breach at a pediatric hospital. The incident impacted more than 105,300 patients.
