Phishing Attack Impacts 2,200 Kent County Community Mental Health Authority Patients
Starting on October 28, 2018, Kent County Community Mental Health Authority, dba Network180, experienced a targeted phishing attack.
As is common in advanced phishing attacks, the emails appeared to have been sent from a trusted source. Between November 2 and November 13, three employees responded to the emails and disclosed their credentials, which allowed their encrypted email accounts to be accessed by an unauthorized individual.
At least one of the compromised email accounts contained the protected health information (PHI) of patients. A wide range of PHI was included in the emails stored in the compromised account.
The types of information that could potentially have been accessed by the attacker varied from patient to patient, but may have included names, addresses, dates of birth, Medicaid/Medicare ID numbers, Internal ID numbers, Waiver Support Application (WSA) numbers, names of healthcare providers, schools that were attended, names of relatives, ethnicity/race, and the Social Security numbers of 20 patients. No financial information is believed to have been exposed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The internal investigation into the attack uncovered no evidence to suggest any PHI was accessed, viewed, or misused.
Network180 had security measures in place to keep the PHI of patients private and confidential but those controls were bypassed on this occasion. The internal investigation, conducted by the IT department, HIPAA Privacy Officer, HIPAA Security Officer, and Network180’s HIPAA legal counsel, concluded that the attack was not preventable.
All passwords were reset and unauthorized access is no longer possible. Additional safeguards have now been implemented to improve email security.
While PHI access/theft is not suspected, out of an abundance of caution, all affected patients have been offered at least 12 months of complimentary identity theft protection services through Experian.
