Medical College of Wisconsin Reports Email Breach
Almost 3,200 patients of the Medical College of Wisconsin have been notified that some of their protected health information has potentially been viewed by an unauthorized individual.
A security breach was suspected when IT staff noticed unusual activity associated with the email account of an employee. Rapid action was taken to block access to the email account and the College enlisted the help of an external computer forensics company to conduct a thorough investigation into the activity.
On August 3, 2016, the firm determined the email account had been accessed by an unauthorized third party and a full forensic analysis of email accounts, servers, and networks was initiated. The firm concluded that no other MCW systems had been compromised. Access was only gained to a single email account. The email account was accessed by the third party between July 2, and July 4, 2016 inclusive.
All emails in the account were checked by the firm to determine whether any protected health information could potentially have been accessed. The PHI in the email account was limited to the full names of patients, medical record numbers, home addresses, dates of birth, medical codes, and medical notes concerning diagnoses and treatments.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Highly sensitive information such as insurance details, credit card details and financial information were not exposed so the risk to patients is believed to be low. The Social Security numbers of two patients were present in the email account. Those patients will be offered credit monitoring and identity theft protection services. All other patients have been advised that they do not need to take any further action to protect their identities or credit accounts.
The Medical College of Wisconsin has not received any reports of inappropriate use of patient data and the forensics firm was unable to find any evidence to suggest that the emails containing PHI had actually been opened, viewed, or copied.
Appropriate authorities, including the Department of Health and Human Services’ Office for Civil Rights, have been notified of the incident. The OCR breach report indicates 3,179 patients were impacted by the incident.
