Goshen Health Notifies 9,160 Patients of Historic PHI Breach
Goshen Health in Indiana has started notifying 9,160 patients that some of their protected health information (PHI) may have been compromised in a phishing-related email breach in August 2018.
Upon discovery of the breach the compromised email accounts were secured and the breach was investigated. At the time, the security breach was determined not to require notifications to patients as PHI did not appear to have been compromised. However, on August 1, 2019, Goshen Health became aware that the compromised email accounts did contain the PHI of certain patients and notification letters were necessary.
The breach occurred between August 2, 2018 and August 13, 2018. An unidentified, unauthorized individual gained access to the email accounts of two Goshen colleagues. Following the breach, Goshen Health enhanced its email security protections and as part of that process used additional forensic tools and technology to re-evaluate the breach.
Third-party forensics experts were retained in November 2018 to reassess the incident, but no evidence of unauthorized PHI access or PHI theft was uncovered. Part of the evaluation involved a detailed search of the compromised email accounts to determine whether they contained any sensitive patient information. Almost a year to the day after the first account compromise, the accounts were contained to contain the PHI of certain patients.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The PHI in the accounts included names, addresses, dates of birth, health insurance information, physicians’ names, Social Security numbers, driver’s license numbers, and limited clinical information.
The breach was reported to the HHS’ Office for Civil Rights on September 30, 2019 and notification letters were sent to affected patients the same day. Individuals whose Social Security number or driver’s license number were exposed have been offered 12 months of complimentary credit monitoring and identity theft protection services.
Further training has now been provided to staff members related to email security and phishing awareness.
