Children’s Hospital Colorado is contacting 2,553 patients to inform them that some of their protected health information was held in an email account that was accessed by an unauthorized person between April 6-12, 2020.
Credentials to access the account were stolen when an employee answered a phishing email. The phishing attack was discovered by the hospital on June 22, 2020 and the account was immediately safeguarded. A review of the emails and email attachments in the account showed they included patient names, zip codes, dates of service, medical record numbers, and clinical diagnosis data.
Measures have since been implemented to harden email security defenses, platforms are being evaluated for educating staff on cybersecurity, and technical controls related to email are also being tested.
Stolen Hoag Clinic Laptop Included Unencrypted PHI
On June 5, 2020, a laptop computer given to an employee of the Hoag Clinic in Costa Mesa, CA was stolen from a car parked in the worksite parking lot in Newport Beach. The theft was identified the same day and law enforcement was notified, but the laptop computer has not been found.
The IT security team found that the laptop contained the protected health information of 738 individuals, including first and last names, middle initial, address, phone number, date of birth, age, medical record number, e-mail address, physician name, whether the patient is being followed by case management, if a COVID-19 test has been completed, if the individual had been moved to case management, if a telehealth visit had been scheduled, communication status notes, and if the individual was seeking home health.
The Hoag clinic has re-trained the workforce on security measures, enhanced policies covering the transportation of laptop computers between worksites, and a thorough security assessment has been conducted to ensure all proper cybersecurity safeguards are in place. Affected individuals have been offered free membership to the Experian IdentityWorks identity theft detection and resolution service for one year.