PHI of 17,531 Patients Potentially Compromised in Business Associate Phishing Attack
Women’s Health USA Inc., an Avon, CT-based business associate that provides a range of practice management services to healthcare organizations, has experienced a phishing attack that has resulted in the exposure of patients’ protected health information.
An investigation was launched following the discovery of suspicious activity within certain employee email accounts. The affected email accounts were secured, and a leading cybersecurity firm was engaged to assist with the investigation and determine the nature and extent of the breach.
The investigation confirmed that the email accounts of two employees had been accessed by unauthorized individuals as a result of the employees responding to phishing emails and disclosing their email credentials. The first email account breach occurred on April 5, 2018 and the second account was breached on August 13, 2018.
A review of the emails and email attachments in the account revealed they contained a limited amount of protected health information. The exposed information varied from patient to patient but may have included name, date of birth, Medicare Health Insurance Claim Number (HICN), health insurance policy number, diagnosis information, treatment information, and Social Security number.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Women’s Health USA notified all affected healthcare provider clients about the breach on March 15, 2019 and started sending breach notification letters to all affected patients on March 29, 2019.
All employees have been provided with further training to help them identify phishing emails and to improve awareness of other cybersecurity issues. Additional security measures have also been implemented to enhance email security.
The phishing attack and data breach has been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach summary indicates 17,531 patients were affected by the breach.
