HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Email Hacking Incident Reported by Episcopal Health Services

Certain current and former patients of St. John’s Episcopal Hospital and Episcopal Health Services in New York are being notified that some of their protected health information has potentially been compromised.

On September 18, 2018, Episcopal Health Services became aware of suspicious activity in several employee email accounts. An investigation was immediately launched, and a third-party digital forensics firm was called in to determine the nature and scope of the breach. The investigation revealed multiple employee email accounts had been compromised between August 28, 2018 and October 5, 2018.

A thorough review of the compromised email accounts was completed on November 1. The types of information exposed differed from patient to patient but may have included name, date of birth, Social Security number, medical history, prescription information, diagnoses, treatment information, medical record number, financial information, and health insurance information.

“Episcopal Health Services is committed to, and takes very seriously, its responsibility to protect all data entrusted to us. We are continuously taking steps to enhance data security protections,” explained Episcopal Health Services in its substitute breach notice. The measures taken to improve security include a forced password reset on all employee email accounts and the implementation of additional email security controls to prevent further unauthorized access.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

While no evidence of data theft or misuse was uncovered during the investigation, out of an abundance of caution, Episcopal Health Services has offered all affected individuals 12 months of credit monitoring services without charge. Due to the sensitive nature of the information that was exposed, Episcopal Health Services has advised patients to monitor their account statements for any sign of suspicious activity.

The breach report submitted to the HHS’ Office for Civil Rights on November 19, 2018 indicates 218,055 individuals were impacted by the phishing attacks.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.