United Hospital District Phishing Attack Impacts 2,143 Patients
Blue Earth, MN-based United Hospital District has discovered patient information was exposed and potentially accessed by an unauthorized individual as a result of a June 2018 phishing attack.
The phishing incident resulted in the compromise of a single email account, the credentials to which were obtained as a result of an employee responding to a phishing email. The substitute breach notice on the healthcare provider’s website indicates the account was compromised between June 10, 2018 and June 27, 2018.
An in-depth analysis of the compromised account was conducted by third-party cybersecurity professionals who determined on December 12, 2018, that patient information had potentially been accessed. Emails and file attachments in the account were found to contain the protected health information of 2,143 patients.
The types of information contained in the email account varied from patient to patient and may have included names, addresses, internal patient identification numbers, health insurance information and, for a limited number of affected patients, diagnoses, treatment information, and/or Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While data access was possible it was not confirmed. No reports have been received that suggest there has been any misuse of patient information.
All patients affected by the breach have been notified by mail. Individuals whose Social Security number was exposed have been offered a free 12-month subscription to credit monitoring and identity theft restoration services.
In response to the breach, additional email security measures have been implemented and employees have been given further security awareness training.
