Phishing Attack Impacts 14,305 Patients of Main Line Endoscopy Centers
Main Line Endoscopy Centers, a network of outpatient endoscopy facilities in the Malvern, Bala Cynwyd, and Media regions of Pennsylvania, has discovered an unauthorized individual has gained access to the email account of one of its employees following a response to a phishing email.
It is not clear exactly when the account was breached, but it was discovered by Main Line on January 30, 2019.
A leading computer forensics firm was retained to assist with the investigation and determine which, if any, emails in the account had been opened and whether any patient information had been compromised. The investigation confirmed that the attackers potentially gained access to the protected health information of certain patients, which included names, dates of birth, and limited clinical information. Some patients also had their Social Security number, driver’s license number, and/or health insurance information exposed.
All patients affected by the breach were sent breach notification letters on March 29, 2019 and individuals whose Social Security number or driver’s license number were exposed have been offered complimentary identity theft protection services for 12 months at no cost.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
As a precaution, all individuals affected by the breach have been advised to monitor their accounts, explanation of benefits statements, and credit reports closely for any sign of fraudulent use of their information.
To improve security and prevent further breaches, Main Line has provided further training to all staff to improve email security awareness and alert them to the threat from phishing. Multi-factor authentication has been implemented to prevent accounts from being accessed in the event that further credentials are compromised along with other security measures.
The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights. The OCR breach portal indicates 14,305 patients were affected by the breach.
