HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

RiverMend Health Email Breach Impacts 1300 Patients

Augusta, GA-based RiverMend Health, a provider of specialty behavioral health services including services for drug and alcohol addiction, has discovered an unauthorized individual has gained access to the email account of one of its employees.

The unauthorized access was detected on August 10, 2017, when suspicious emails were identified being sent from the employee’s account. The suspicious email activity was investigated and access to the account was blocked on August 11, 2017. The investigation revealed access to the account was first gained two weeks previously on July 27.

During the two weeks that the email account was accessible, it is possible that the employee’s emails were accessed by the attacker. Those emails contained a range of protected health information of 1,300 current and former patients.  RiverMend Health has retained the services of a leading computer forensics firm to assist with the investigation and determine the full nature of the breach and the extent of the attack. RiverMend Health has not disclosed how access to the email account was gained, but has said steps have been taken to prevent further breaches of this nature from occurring.

The investigation has not uncovered any evidence to suggest emails – and PHI – were accessed, stolen, or misused, nor that the theft of protected health information was the reason for the attack. However, it was not possible to rule out PHI access with a high degree of certainty.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Patients have now been notified of the breach by mail and have been advised that the following information was potentially accessed: names, age or date of birth, address, referral source, RiverMend facility used, services rendered, demographic information, insurance and/or billing details, and diagnostic information.

All patients impacted by the breach have been encouraged to exercise caution and check their credit reports, accounts, and explanation of benefits statements for any sign of suspicious activity and to report any suspicious activity to RiverMend immediately.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.