The HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Star Refining & Express MRI Report Phishing Attacks

The Peachtree Corners, GA-based medical imaging center, Express MRI, has started notifying patients that some of their protected health information has been exposed in a historic data breach. Express MRI discovered on July 10, 2020 that an unauthorized individual had gained access to one of its email accounts and used that account to send unauthorized emails. The incident was investigated at the time, but it was determined that no patient information had been accessed.

A secondary review of the security breach was conducted on June 10, 2021, and while no specific evidence was uncovered that indicated there had been unauthorized data access or data theft, Express MRI concluded that it was not actually possible to totally rule out unauthorized data access or exfiltration, therefore breach notification letters were warranted.

A review of the compromised account confirmed the following information may have been accessed or acquired: Names, addresses, email addresses, dates of birth, patient ages, referring physician names, body part scanned, and whether the scan was related to a workers’ compensation claim or motor vehicle accident investigation. No other patient data were present in the compromised email accounts.

Express MRI said it took, “significant and immediate steps” to respond to the incident, including assembling a team of highly qualified experts to reinforce the security of its information systems and implement additional safeguards to prevent further breaches.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Star Refining Phishing Attack Affects 1,910 Individuals

Adelda Health, Inc. dba Star Refining, has discovered the personal information of 1,910 individuals has potentially been viewed or obtained by unauthorized individuals who gained access to the email accounts of several of its employees following responses to phishing emails.

The breach was detected by the West Palm Beach, FL-based dental refining company on April 29, 2021 and a third-party computer forensics firm was engaged to ensure the incident was fully remediated and to determine the nature and scope of the breach.

A review of the compromised email accounts revealed they contained sensitive data such as first and last names, mailing addresses, driver’s license numbers, Social Security numbers, and credit card/financial information; however, no evidence was found that indicated emails containing that information were viewed or acquired during the time the accounts were accessible. The first of the accounts were discovered to have been accessed on April 12, 2021.

Notifications started to be sent to affected individuals on July 22, 2021. Complimentary Experian Identity Works credit monitoring and identity theft protection services have been offered to affected individuals.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist