An employee’s email account, that contained the protected health information of approximately 8,400 patients of Billings Clinic in Billings, MT has been illegally accessed.
The breach was discovered by the clinic’s cybersecurity systems on May 14, 2018, with unusual activity activated an alert. Swift action was taken to safeguard the account, although it is possible that the PHI of patients could have been seen or copied.
The information in the account was restricted. No financial information was accessed, medical records were not obtained, and no Social Security numbers were held in the account. Data in the account had been used for scheduling and related to patients who received medical treatment between 2008 and 2011.
The breach was restricted to names, dates of birth, contact information, diagnoses, descriptions of medical services supplied, medical record details and internal financial control numbers. The investigation showed that the breach was restricted to the email account of one employee.
While data breaches such as this can easily occur due to staff members responding to phishing attacks, in this case access is thought to have been gained by another manner. The employee concerned had recently been overseas on a medical mission. The email credentials were downloaded by the unauthorized person while the employee was away on the mission.
Login detail can easily be intercepted when connecting to unsecured public Wi-Fi networks, or if a connection is made to a rogue Wi-Fi hotspot.
Any healthcare group that allows staff members to take devices containing PHI overseas, or allows workers to access protected health information remotely, should ensure staff memberss undergo security awareness training and are made aware of the dangers of connecting to public Wi-Fi networks.
Policies should also be formulated that require those staff members to only connect to the Internet using a virtual private network (VPN). It is also vital to ensure VPN software is updated and it is advisable to put in place a web filtering solution to safeguard workers when not on the corporate network.
