Phishing Attack Potentially Compromised PHI of 41,000 Cancer Centers of America Patients

by | Dec 10, 2018

Cancer Centers of America’s Western Regional Medical Center, located in Bullhead City, has revealed that a staff email account has been hacked following a phishing email attack.

The phishing email seems to have been broadcast from the staff email account of a Cancer Treatment Centers of America executive. The email appear to have employed used social engineering techniques to trick the employee into revealing login credentials to the account.

The hacker was able to access the account, but only for a short period of time as the incident was discovered by IT staff and the user’s account password was reset. However, during the period of time that the email account was accessible some messages containing patients’ protected health information (PHI) may have been visible.

Cancer Treatment Centers of America hired a computer forensics firm to help with the investigation. While it was not possible to identify which, if any, emails were seen, it was found that the compromised email account included the PHI of 41,948 clients.

The details in the emails were different from patient to patient and may have incorporated: Name, address, email address, date of birth, medical record number, treatment appointments, facility attended, physician name, type of cancer, and health insurance details. A small number of Social Security numbers were visible but the emails did not include any financial details.

Free credit auditing and identity theft protection services have been provided to all patients whose Social Security number was exposed. Cancer Treatment Centers of America has since supplied additional training to staff members to assist them identify suspicious emails.

The breach took place on May 2, 2018 and the CTCA Information Technology Department swiftly took measures to reset the account; however, the Cancer Treatment Centers of America online portal breach notice states that CTCA only became knowledgeable of the breach of PHI on September 26, 2018.

The breach was officially made known to the Department of Health and Human Services’ Office for Civil Rights (OCR) on November 26, 2018.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy