Email Security Breaches Expose PHI of Seattle Community Psychiatric Clinic Patients
Community Psychiatric Clinic in Seattle, WA, a provider of accredited outpatient, mental health treatment, and counselling services, has experienced two security breaches in which patient information may have been compromised. In both cases, an unauthorized individual gained access to an employee’s Microsoft Office 365 account.
The first security breach was detected on March 12, 2019 when an employee’s account was subjected to unauthorized access. The affected account was immediately secured, passwords were changed, and the employee’s hard drive was restored. The email account also had additional protections added to prevent similar breaches from occurring in the future. The investigation did not uncover any evidence to suggest that patient data had been stolen.
Around two months later on May 8, 2019, a second email account was discovered to have been compromised in a separate attack. The attacker used the email account to send a fraudulent wire transfer request to another member of staff. The transfer was executed, but due to the fast response of the clinic, it was possible to recover all the funds. A password reset was performed to lock out the attackers and additional protections have now been implemented on the breached account to reduce the risk of further attacks. Again, no evidence was found to suggest patient information had been stolen.
A forensic investigation revealed that in addition to the above two accounts, a further two accounts had also been compromised. The investigators note that since the attackers accessed the mailboxes through Outlook Web Access, it significantly reduced the potential for large scale data exfiltration. The lack of evidence of data exfiltration suggests the attackers did not succeed in obtainment patient information, but patients have been notified as a precaution.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The breaches have yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal so it is currently unclear how many patients have been affected.
