HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Phishing Attack Potentially Impacts 80,000 Patients of Washington University School of Medicine

A phishing attack on the Washington University School of Medicine has resulted in a number of staff members’ email accounts being compromised.

Washington University School of Medicine learned of the phishing attack on January 24, 2017, more than seven weeks after the attack occurred. An investigation into the incident revealed the attack occurred on December 2, 2016.

Phishing emails use a variety of social engineering techniques to fool end users into revealing sensitive information such as usernames, passwords, or bank details. In this case, the phishing emails were used to obtain login credentials to staff members’ email accounts.

Email accounts contain a treasure trove of information. An investigation revealed the compromised accounts contained the protected health information of 80,270 patients. Data in the accounts included patients’ names, dates of birth, medical record numbers, clinical information, medical diagnoses and treatment information. Some patients’ Social Security numbers were also exposed as a result of the attack.

The investigation did not uncover any evidence to suggest any of the information in the accounts had been misused, although due to the length of time that the attackers potentially had access to the accounts, it is possible that information was accessed and stolen.

Washington University School of Medicine started notifying affected individuals of the exposure of their PHI on March 24 and the incident has been reported to law enforcement which is conducting an investigation.

To prevent future incidents of this nature from occurring, Washington University School of Medicine will be reeducating staff members of existing protocols regarding phishing emails. Logon authentication processes and business practices will also be strengthened.

Preventing staff from responding to phishing emails is a major challenge. Cybersecurity training can be provided to employees, but as this incident shows, training is not always effective.

Organizations can greatly improve their resilience to phishing attacks by conducting dummy phishing attacks. Dummy phishing exercises highlight areas of weakness and allow healthcare organizations to identify which members of staff require further training. Research conducted by PhishMe shows that with practice, employees’ phishing identification skills can be significantly improved.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.