HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

InterAct of Michigan Discovers Email Account Compromise

InterAct of Michigan, a provider of mental health and substance abuse treatments through clinics in Kalamazoo and Grand Rapids, has discovered an unauthorized individual has gained access to the email account of an employee and potentially viewed and copied the protected health information of 1,290 patients.

The attack was discovered on June 8, 2018 prompting a thorough investigation to determine the nature and scope of the breach. Immediate action was taken to terminate access to the compromised account and an internal investigation was launched. A leading computer forensics company was retained to provide assistance with the investigation.

On July 30, 2018, InterAct of Michigan determined that the protected health information of certain patients had potentially been accessed. The information was present in emails and email attachments in the compromised account. The exposed PHI included clients’ names and Social Security numbers. For some patients, date of birth, prescription details, and treatment history may also have been accessed.

Due to the sensitive nature of the information that was compromised, all affected patients have been offered complimentary identity theft protection services for 12 months.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

On August 7, 2018, notifications were mailed to affected individuals and Department of Health and Human Services’ Office for Civil Rights was notified of the breach.

InterAct of Michigan has taken steps to improve security to prevent further breaches and ensure that in the event of a further email account compromise, the breach will be detected much more rapidly.

Email access logs are now being reviewed on a weekly basis to identify any suspicious behavior and single user inbox rules are similarly being monitored. A rule has also been set up that prevents the forwarding of emails to external email accounts, which suggests such a rule may have been set up by the threat actor responsible for this attack.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.