HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Health First Phishing Attack Impacts 42,000 Customers

Health First Inc., a four-hospital Florida-based health system, experienced a hacking/IT incident earlier this year that was reported to the Department of Health and Human Services’ Office for Civil Rights on October 5. According to the OCR breach summary, 42,000 customers were affected by the breach. Further information has now been released on the nature of the breach.

According to Health First, the email accounts of multiple employees were compromised in the phishing attack. The exposed protected health information was contained in the compromised email accounts. The electronic medical record system was unaffected by the attack.

An investigation into the breach revealed the attackers first gained access to employee email accounts in February 2018. Those email accounts were used to conduct further phishing attacks on other Health First employees until May 2018.

According to Health First, the attackers gained access to “a small number” of employee email accounts. The compromised email accounts contained a limited amount of protected health information such as names, addresses, and birth dates, although some individuals’ Social Security numbers were also exposed. No medical information or financial information was compromised.

A forensic review was conducted to determine the nature of the breach and the individuals impacted. Based on that review, Health First does not believe the attackers were interested in viewing emails or obtaining protected health information. The attackers only appeared to be interested in compromising more email accounts to conduct further phishing scams. The review showed only a small number of emails were accessed by the attackers.

Upon discovery of the breach, Health First changed the passwords on all compromised email accounts to prevent any further access and new security measures have now been implemented.

All affected patients have been notified of the breach by mail and offered AllClear ID identity theft monitoring and repair services for 12 months without charge.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.