HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

University of Utah Health Suffers Further Phishing Attack

University of Utah Health has suffered another phishing attack, with the latest incident resulting in the exposure of the protected health information (PHI) of 2,700 patients.

This is the third phishing incident to be reported to the HHS’ Office for Civil Rights by the University of Utah this year. The previous incidents were reported on March 21 and April 3 and affected 3,670 and 5,000 patients respectively.

In the latest attack, an unauthorized individual gained access to employee email accounts between April 6 and May 22, 2020 as a result of responses to phishing emails. The email accounts were promptly secured, and an investigation was launched to determine whether the attackers gained access to patients’ PHI.

It was not possible to tell whether PHI was accessed or exfiltrated, but the accounts did contain a limited amount of PHI which was potentially accessed. An analysis of emails and attachments in the compromised accounts revealed they contained names, medical record numbers, dates of birth, and some clinical information related to the medical services received at University of Utah Healthcare facilities.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The investigation into the phishing attacks is ongoing, but so far, no evidence has been found to indicate any PHI was stolen by the attackers and no reports have been received to suggest there has been misuse of PHI. Notification letters started to be sent to affected patients on June 5, 2020.

University of Utah Health explained in its substitute breach notice that its information security protocols are being reviewed and security procedures will be reinforced with its employees to improve resilience to phishing attacks in the future. Security enhancements will be implemented across the entire enterprise and multi-factor authentication will be used to prevent email account access if credentials are compromised in the future.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.