On October 5, 2018, Health First submitted a HIPAA Email Breach to the U.S. Department of Health and Human Services (HHS).
Based in Rockledge, Florida, Health First’s email breach affected 42,000 individuals’ protected health information.
Health First is classified as a Healthcare Provider.
According to this report about Health First’s breach:
Health First Inc., a four-hospital Florida-based health system, experienced a hacking/IT incident earlier this year that was reported to the Department of Health and Human Services’ Office for Civil Rights on October 5. According to the OCR breach summary, 42,000 customers were affected by the breach. Further information has now been released on the nature of the breach.
According to Health First, the email accounts of multiple employees were compromised as part of a phishing campaign. The exposed protected health information was contained in the compromised email accounts. The electronic medical record system was unaffected by the attack.
An investigation into the breach revealed the attackers first gained access to employee email accounts in February 2018. Those email accounts were used to conduct further phishing attacks on other Health First employees until May 2018.
According to Health First, the attackers gained access to “a small number” of employee email accounts. The compromised email accounts contained a limited amount of protected health information such as names, addresses, and birth dates, although some individuals’ Social Security numbers were also exposed. No medical information or financial information was compromised.
A forensic review was conducted to determine the nature of the breach and the individuals impacted. Based on that review, Health First does not believe the attackers were interested in viewing emails or obtaining protected health information. The attackers only appeared to be interested in compromising more email accounts to conduct further phishing scams. The review showed only a small number of emails were accessed by the attackers.
Upon discovery of the breach, Health First changed the passwords on all compromised email accounts to prevent any further access and new security measures have now been implemented.
All affected patients have been notified of the breach by mail and offered AllClear ID identity theft monitoring and repair services for 12 months without charge.
HHS Wall of Shame
The HHS Wall of Shame is a website under the jurisdiction of HHS that lists all HIPAA breaches reported within the last 24 months. The Wall of Shame displays breaches that are currently under investigation by the Office for Civil Rights.
As part of section 13402(e)(4) of the HITECH Act, the HHS Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.
HIPAA Breach Report
The Paubox HIPAA Breach Report analyzes breaches that affected 500 or more individuals as reported in the HHS Wall of Shame.