Alomere Health in Alexandria, MN is notifying almost 50,000 patients that some of their protected health information was potentially accessed by unauthorized individuals as a result of a phishing attack.
Alomere Health learned about the phishing attack on November 6, 2019 and launched an internal investigation which confirmed the account was accessed by an unauthorized individual between October 31 and November 1, 2019.
A computer forensics company was engaged to assist with the investigation and discovered on November 10, 2019 that a second email account had been breached on November 6.
A comprehensive review of the compromised accounts revealed some emails and email attachments contained protected health information. The types of information potentially compromised in the attack varied from patient to patient and may have included the following data elements: Names, addresses, dates of birth, medical record numbers, health insurance information, treatment information, and/or diagnosis information. A limited number of Social Security numbers and driver’s license numbers were also found in the accounts.
Alomere Health was unable to confirm whether any emails or email attachments containing protected health information were accessed or copied by the attackers, but unauthorized PHI access and data theft could not be ruled out. On January 3, 2020, Alomere Health sent notifications to all 49,351 patients whose information was present in the email accounts.
Individuals whose Social Security number or driver’s license number were exposed have been offered complimentary credit monitoring and identity theft protection services for 12 months. No reports of misuse of patient information have been received to date.
Alomere Health has now added more layers to its cyber defenses and further security awareness training has been given to employees to help them identify phishing emails and other email-based threats.
The post Alomere Health Phishing Attack Impacts 49,351 Patients appeared first on HIPAA Journal.