Share this article on:
Essentia Health, an integrated health system serving Minnesota, Wisconsin, North Dakota, and Idaho, is sending notifications to more than 1,000 patients alerting them to the exposure of some of their protected health information (PHI).
Like many healthcare providers, Essentia Health works with a third-party vendor that provides billing services to help recover lost revenue. Those services were provided by a Bruno, MN-based billing services firm called Nemadji Research Corporation.
Essentia Health provided Nemadji with certain types of PHI to allow the company to perform its contracted services. Essentia Health did not disclose exactly what types of information were exposed in the substitute breach notice posted on its website.
On March 28, 2019, Nemadji discovered unusual activity in an employee’s email account. The investigation revealed the employee had fallen for a phishing scam and had disclosed login credentials to the attacker. The account was subjected to unauthorized access for a period of several hours before the account was deactivated.
The subsequent investigation revealed the email account contained the PHI of patients of some of its clients. The L.A. Times had previously reported that the phishing attack had exposed the PHI of 14,591 Los Angeles Department of Health Services (DHS) patients. The latest report from Essentia Health shows the breach was more widespread.
It is currently unclear how many of the company’s clients were affected. The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is also unknown how extensive the breach was.