Share this article on:
Certain current and former patients of St. John’s Episcopal Hospital and Episcopal Health Services in New York are being notified that some of their protected health information has potentially been compromised.
On September 18, 2018, Episcopal Health Services became aware of suspicious activity in several employee email accounts. An investigation was immediately launched, and a third-party digital forensics firm was called in to determine the nature and scope of the breach. The investigation revealed multiple employee email accounts had been compromised between August 28, 2018 and October 5, 2018.
A thorough review of the compromised email accounts was completed on November 1. The types of information exposed differed from patient to patient but may have included name, date of birth, Social Security number, medical history, prescription information, diagnoses, treatment information, medical record number, financial information, and health insurance information.
“Episcopal Health Services is committed to, and takes very seriously, its responsibility to protect all data entrusted to us. We are continuously taking steps to enhance data security protections,” explained Episcopal Health Services in its substitute breach notice. The measures taken to improve security include a forced password reset on all employee email accounts and the implementation of additional email security controls to prevent further unauthorized access.
While no evidence of data theft or misuse was uncovered during the investigation, out of an abundance of caution, Episcopal Health Services has offered all affected individuals 12 months of credit monitoring services without charge. Due to the sensitive nature of the information that was exposed, Episcopal Health Services has advised patients to monitor their account statements for any sign of suspicious activity.
The breach report submitted to the HHS’ Office for Civil Rights on November 19, 2018 indicates 218,055 individuals were impacted by the phishing attacks.