Email HIPAA Breach Affects 1300 Patients of RiverMend Health

by | Oct 24, 2017

RiverMend Health, a Augusta, GA-based specialty behavioral health provider has reported an unauthorized person has gained access to the email account of one of its employees after suspicious emails were identified being sent from that employee’s account.

The unauthorized access was discoverd on August 10, 2017. The suspicious email activity was examined and access to the account was restricted the following day. The breach investigation showed access to the account was first obtained two weeks earlier on July 27.

In the two weeks that the email account was being accessed, it is possible that the employee’s emails were viewed by the attacker. Those emails held a variety of protected health date pertaining to 1,300 current and former patients. RiverMend Health has employed the services of a well-known computer forensics firm to help with the investigation and determine the full details of the breach and the extent of the attack. RiverMend Health has not released how access to the email account was obtained, but has stated that steps have been taken to stop further breaches of this nature from happening.

The investigation has, so far, not found any evidence to suggest emails – and PHI – were accessed, stolen, or misused, nor that the theft of protected health information was the motivation for the cyberattack. However, it was not possible to eliminate PHI access with a high degree of certainty.

Patients have now been advised of the breach by mail and have been warned that the following information was possibly accessed: names, age or date of birth, address, referral source, RiverMend facility used, services rendered, demographic information, insurance and/or billing details, and diagnostic data

All patients affected by the breach have been told to use caution and examine their credit reports, accounts and explanation of benefits statements for any sign of unusual activity and to report any suspicious activity to RiverMend as soon as possible.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy