Minnesota DHS Notifies 21,000 Patients That Their PHI Has Potentially Been Compromised
The Minnesota Department of Human Services has mailed letters to approximately 21,000 individuals on medical assistance to alert them to a possible breach of their protected health information (PHI) due to two recent phishing attacks.
Two DHS employees’ email accounts have been confirmed as having been compromised as a result of the employees clicking on links in phishing emails. The investigation into the breach determined that the attackers accessed both email accounts although it was not possible to determine which, if any, emails in the account had been accessed or copied by the attackers.
Minnesota DHS has reason to believe that other employees may also have been targeted and could also have clicked on links in phishing emails, but it has not yet been confirmed whether their accounts have been breached. The investigation into the phishing attacks is ongoing.
The two email account breaches occurred on June 28 and July 9, 2018, although the IT department only determined that the accounts had been breached in August. Upon discovery of the phishing attack, both accounts were secured to prevent further access.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
It has taken a considerable amount of time to conduct the investigation and determine which patients have been affected. That process required every single email in each account to be checked for patient information, hence the delay in issuing breach notification letters.
Most of the individuals affected by the breach had previously interacted with the State Medical Review Team, although some individuals who had received services from Minnesota DHS Direct Care and Treatment facilities also had some of their PHI exposed.
The PHI in the compromised email accounts included full names, addresses, telephone numbers, birth dates, Social Security numbers, educational records, medical information, employment information, and financial information.
“We immediately took steps to secure these accounts, and currently have no evidence that any information was actually viewed, downloaded or misused,” explained Minnesota DHS in a statement about the breach. “We take data privacy very seriously at DHS, and continue to work with our employees and partners to prevent cyberattacks.”
