Lafourche Medical Group, a Louisiana-based urgent care center operator, has notified 34,862 patients about a security breach that potentially involved some of their protected health information.
On March 30, 2021, Lafourche Medical Group learned that an external accountant had responded to a phishing email that spoofed one of the owners of Lafourche Medical Group and disclosed login credentials to the attacker. The compromised credentials were used to gain access to the group’s Microsoft 365 environment.
A third-party IT company was engaged to assist with the investigation, but found no evidence to suggest its on-premise systems or cloud-based electronic medical record system were compromised; however, the credentials could have been used to view or download data from its Microsoft 365 environment, which contained some patient information. “Due to the size of the email system, we are unable to identify all potential patient information that may have been contained in the system,” explained Lafourche Medical Group in its substitute breach notice.
Clinical information was not compromised; however, emails were used to communicate certain patient information for billing and other clinic purposes. The types of information often sent via email includes names, addresses, dates of birth, dates of service, e-mail addresses, telephone numbers, medical record numbers, insurance and health plan beneficiary numbers, guarantor names, diagnoses, treating practitioner names, and lab test results.
A more robust vetting process has been implemented for business associates and a third-party IT consultancy was engaged to reassess its computer system and security measures and to recommend best practices for improving information security. Several measures have now been implemented to improve security, including strengthening the firewall and spam and malware filters, implementing stricter password policies, adding multi-factor authentication for mobile access, and retraining the staff on cybersecurity, social engineering, and phishing.
The post Third-Party Phishing Attack Affects Up to 34,862 Lafourche Medical Group Patients appeared first on HIPAA Journal.