University of Utah Health Suffers Further Phishing Attack
University of Utah Health has suffered another phishing attack, with the latest incident resulting in the exposure of the protected health information (PHI) of 2,700 patients.
This is the third phishing incident to be reported to the HHS’ Office for Civil Rights by the University of Utah this year. The previous incidents were reported on March 21 and April 3 and affected 3,670 and 5,000 patients respectively.
In the latest attack, an unauthorized individual gained access to employee email accounts between April 6 and May 22, 2020 as a result of responses to phishing emails. The email accounts were promptly secured, and an investigation was launched to determine whether the attackers gained access to patients’ PHI.
It was not possible to tell whether PHI was accessed or exfiltrated, but the accounts did contain a limited amount of PHI which was potentially accessed. An analysis of emails and attachments in the compromised accounts revealed they contained names, medical record numbers, dates of birth, and some clinical information related to the medical services received at University of Utah Healthcare facilities.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The investigation into the phishing attacks is ongoing, but so far, no evidence has been found to indicate any PHI was stolen by the attackers and no reports have been received to suggest there has been misuse of PHI. Notification letters started to be sent to affected patients on June 5, 2020.
University of Utah Health explained in its substitute breach notice that its information security protocols are being reviewed and security procedures will be reinforced with its employees to improve resilience to phishing attacks in the future. Security enhancements will be implemented across the entire enterprise and multi-factor authentication will be used to prevent email account access if credentials are compromised in the future.
