Phishing Attack Impacts 14,305 Patients of Main Line Endoscopy Centers

Main Line Endoscopy Centers, a network of outpatient endoscopy facilities in the Malvern, Bala Cynwyd, and Media regions of Pennsylvania, has discovered an unauthorized individual has gained access to the email account of one of its employees following a response to a phishing email.

It is not clear exactly when the account was breached, but it was discovered by Main Line on January 30, 2019.

A leading computer forensics firm was retained to assist with the investigation and determine which, if any, emails in the account had been opened and whether any patient information had been compromised. The investigation confirmed that the attackers potentially gained access to the protected health information of certain patients, which included names, dates of birth, and limited clinical information. Some patients also had their Social Security number, driver’s license number, and/or health insurance information exposed.

All patients affected by the breach were sent breach notification letters on March 29, 2019 and individuals whose Social Security number or driver’s license number were exposed have been offered complimentary identity theft protection services for 12 months at no cost.

As a precaution, all individuals affected by the breach have been advised to monitor their accounts, explanation of benefits statements, and credit reports closely for any sign of fraudulent use of their information.

To improve security and prevent further breaches, Main Line has provided further training to all staff to improve email security awareness and alert them to the threat from phishing. Multi-factor authentication has been implemented to prevent accounts from being accessed in the event that further credentials are compromised along with other security measures.

The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights. The OCR breach portal indicates 14,305 patients were affected by the breach.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.