HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Phishing Attack Impacts 2,200 Kent County Community Mental Health Authority Patients

Starting on October 28, 2018, Kent County Community Mental Health Authority, dba Network180, experienced a targeted phishing attack.

As is common in advanced phishing attacks, the emails appeared to have been sent from a trusted source. Between November 2 and November 13, three employees responded to the emails and disclosed their credentials, which allowed their encrypted email accounts to be accessed by an unauthorized individual.

At least one of the compromised email accounts contained the protected health information (PHI) of patients. A wide range of PHI was included in the emails stored in the compromised account.

The types of information that could potentially have been accessed by the attacker varied from patient to patient, but may have included names, addresses, dates of birth, Medicaid/Medicare ID numbers, Internal ID numbers, Waiver Support Application (WSA) numbers, names of healthcare providers, schools that were attended, names of relatives, ethnicity/race, and the Social Security numbers of 20 patients. No financial information is believed to have been exposed.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The internal investigation into the attack uncovered no evidence to suggest any PHI was accessed, viewed, or misused.

Network180 had security measures in place to keep the PHI of patients private and confidential but those controls were bypassed on this occasion. The internal investigation, conducted by the IT department, HIPAA Privacy Officer, HIPAA Security Officer, and Network180’s HIPAA legal counsel, concluded that the attack was not preventable.

All passwords were reset and unauthorized access is no longer possible. Additional safeguards have now been implemented to improve email security.

While PHI access/theft is not suspected, out of an abundance of caution, all affected patients have been offered at least 12 months of complimentary identity theft protection services through Experian.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.