Health Plan of San Joaquin (HPSJ), a non-profit Medi-Cal managed care provider based in French Camp, CA, has discovered an unauthorized individual has gained access to its email system and potentially accessed or obtained sensitive data.
A potential email breach was suspected on or around October 12, 2020 when anomalous activity was identified in the email system. HPSJ determined on October 23, 2020 that multiple employee email accounts had been remotely accessed by an unauthorized individual. A password reset was performed on all affected email accounts to prevent further access, and the investigation confirmed that unauthorized access to email accounts occurred between September 26, 2020 and October 12, 2020.
Following any email system breach, all emails in the compromised accounts must be checked to determine whether they contain any sensitive data. That can be a labor-intensive and time-consuming process. In this case, the process involved a programmatic and painstaking manual review, which revealed that the compromised email accounts contained the protected health information of 420,433 individuals.
The delay in issuing breach notification letters was due to the length of time it took to identify PHI in the email accounts, and the subsequent review of internal records to identify up-to-date contact information for those individuals to allow notification letters to be sent. That process has only recently been completed and breach notification letters started to be sent to affected individuals on May 18, 2021.
The types of PHI in the compromised accounts included names, addresses, and Social Security numbers. While unauthorized email account access was confirmed, no reports have been received to indicate there has been any misuse of PHI; although, as a precaution against identity theft and fraud, affected individuals who had their Social Security number exposed have been offered a complimentary 12-month membership to credit monitoring services through Equifax.
The post Health Plan of San Joaquin Email Security Breach Affects 420,433 Individuals appeared first on HIPAA Journal.