Torrance Memorial Medical Center Reports Email Account Compromise
The danger of phishing has been highlighted by an incident reported by Torrance Memorial Medical Center in Claysburg, PA. The medical center discovered the email accounts of two staff members had been accessed by an unauthorized individual.
The incident was detected rapidly, with third party forensic investigators brought in to investigate the breach. The investigation revealed the accounts were accessed on April 18 and April 19.
The investigation revealed the email accounts contained the protected health information of some patients, including names, addresses, dates of birth, Social Security numbers, insurance details and treatment and diagnostic information. The forensic investigation did not uncover evidence to suggest any patient information has been misused, although it was not possible to rule out the possibility that data were accessed by the attackers. Torrance Memorial Medical Center says the breach investigation is ongoing and the incident has been reported to the FBI.
Since there is a risk that PHI was accessed, all affected individuals have been offered one year of credit monitoring and identity theft restoration services without charge.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Torrance Memorial Medical Center is currently working on improving its security controls to prevent future incidents, including retraining staff on safeguarding protected health information and maintaining the privacy and security of its systems.
The data breach has now been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach report shows 46,632 patients were affected by this incident.
Phishing attacks pose a major threat to healthcare organizations. Employees are targeted as they are a weak point in security defenses; however, employees’ security awareness can be greatly improved with regular training and phishing simulations.
Research conducted by PhishMe suggests organizations can reduce susceptibility to phishing attacks by up to 95% by using phishing simulations in addition to training. Other anti-phishing platform providers have released similar figures, showing how effective training can be.
