HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

UAB Medicine Phishing Attack Impacts 19,000 Patients

UAB Medicine is alerting patients about an August 7, 2019 phishing attack that resulted in the email accounts of several employees of UAB Medical Center in Birmingham, AL being accessed by the attackers.

Upon discovery of the breach, the passwords on affected email accounts were changed to prevent further unauthorized access and UAB Medicine engaged a leading cybersecurity firm to investigate the breach.

An analysis of the compromised email accounts revealed they contained the protected health information (PHI) of 19,557 patients, including names and one or more of the following data elements: Medical record number, date of birth, dates of service, location of service, diagnoses, and treatment information. A limited number of patients also had their Social Security number exposed.

UAB Medicine provides security awareness training to its workforce and has taught employees how to identify phishing emails. In this instance, despite that training, several employees responded to the emails and disclosed their email account credentials. Those credentials were used to gain access to email accounts and the payroll system. The health system said the email used in the attack was a fake business survey that appeared to have been sent internally from an executive’s email account.

The aim of the attack appears to have been to gain access to the payroll system to divert employees’ payroll deposits. The attack was detected and blocked before any payroll deposits were redirected. While it is possible that the attackers viewed/copied patient information, no evidence of unauthorized PHI access or data exfiltration was identified and there have been no reports of misuse of patients’ PHI.

Affected individuals have been advised to monitor their accounts and explanation of benefits statements for signs of fraudulent activity and have been offered 12 months’ subscription to credit monitoring and identity theft protection services at no cost. Steps are being taken to improve email security to prevent similar breaches from occurring in the future.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.