Phishing Attack Results in the Exposure of PHI at Morehead Memorial Hospital
Morehead Memorial Hospital in Eden, NC has announced two employees have fallen victim to a phishing attack that resulted in an unauthorized individual gaining access to their email accounts. Those accounts contained the protected health information of patients and sensitive information on employees.
Upon discovery of the breach, access to the email accounts was blocked and the hospital performed a network-wide password reset. Leading computer forensics experts were hired to assist with the investigation and determine the extent of the breach. The investigation confirmed that access to the accounts was possible and sensitive patient and employee information could have been accessed.
While no reports have been received to suggest any information in the accounts has been misused, the possibility of data access and data theft could not be ruled out. The types of information exposed includes names, health insurance payment summaries, health insurance information, treatment overviews, and a limited number of Social Security numbers.
Phishing attacks such as this are common. Emails are sent to healthcare employees that appear to be legitimate communications. The emails typically include hyperlinks that, when clicked, require login details to email accounts to be entered. Entering in that information provides the credentials to the attackers, who then use the information to remotely login to email accounts.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Preventing phishing attacks requires a combination of spam filtering technology to prevent phishing emails from reaching inboxes and education to teach employees about the risk from phishing and how to identify phishing attacks.
In response to the breach, Morehead Memorial Hospital is providing staff members with additional training to help them identify fraudulent communications. An internal webpage has also been created to communicate further information about phishing and email attacks to keep staff better informed.
The incident has been reported to the FBI, Department of Homeland Security and Office for Civil Rights. Patients were notified of the breach by mail on Friday last week and all have been offered identity theft monitoring services for 12 months without charge.
Morehead Memorial Hospital has said the breach impacted approximately 66,000 patients.
