The Henry Ford Health System has started alerting almost 18,500 patients that some of their protected health information may have been been accessed by an unauthorized person.
The breach was found on October 3, 2017 when unauthorized access to the email accounts of several employees of the Detroit-based group was detected. While protected health information was possibly accessed or stolen, the health system’s EHR system was not compromised at any time.All data was limited to the compromised email accounts.
It is currently unclear specifically how access to the email accounts was obtained. Normally, breaches such as this are phishing attacks, where multiple emails are sent to healthcare staff that fool them into disclosing their login details. An internal investigation into the breach is underway to determine the cause of the attack and how the login credentials of some of its workers were stolen.
Henry Ford Health System has completed an examination of all emails in the accounts and has determined that 18,470 patients have been affected. The emails included a range of information on patients including names, medical record numbers, dates of birth, provider’s name, department’s name, location, dates of service, medical diagnoses, and the identity of health insurers. Each patient affected by the breach had some or all of the above information obtained. Financial data and Social Security numbers were not included in any of the compromised email accounts.
At this stage in the review it is unclear whether the person who accessed the accounts viewed or stole any data. and whether any of the PHI has been used for ill means.
Henry Ford Health System stated, “We take very seriously any misuse of patient information, and we are continuing our own internal investigation to determine how this happened and to ensure no other patients are impacted. To reduce future risk of this happening again, we are strengthening our security protections for employees, all of whom will be educated about this measure in the coming weeks.”
Henry Ford Health System will also be looking over its policies on email retention and the use of two-factor security authentication.
