HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Patients Notified of Burrell Behavioral Health Cyberattack and PHI Exposure

Springfield Missouri-based Burrell Behavioral Health has announced it has been the subject of a cyberattack which has potentially resulted in the protected health information of certain patients being obtained by unauthorized individuals.

The electronic medical record system was not accessed, although an unauthorized individual – or individuals – gained access to the organization’s email system between July 6 and July 7, 2016. The unauthorized access was identified on July 7 and counter measures were rapidly deployed to block access to the compromised account.

An internal investigation was launched and a leading cybersecurity company was contracted to conduct a thorough forensic investigation. The investigators were unable to establish whether the protected health information of patients was accessed, although it was not possible to rule out the possibility that PHI had been viewed or obtained in the attack. No reports of identity theft or other misuse of PHI have been received by Burrell Behavioral Health at this point in time.

An analysis of the emails stored I the account revealed that the following data elements could have been accessed: Names, dates of birth, addresses, Social Security numbers, physician’s names, diagnosis codes, health insurance numbers, disability codes, medical diagnoses, treatments provided, treatment locations, and medical record numbers. The information in the email account varied for each patient.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

A substitute breach notice was uploaded to the organization’s website on September 2, 2016 and breach notification letters will be mailed to affected patients in the next few days. All individuals whose information was exposed will be offered credit monitoring and identity theft restoration services (with Kroll) for a period of 12 months without charge.

The incident has now appeared on the Department of Health and Human Services’ Office for Civil Rights breach portal. 7,748 individuals have been impacted by the breach.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.