[BreachExchange] Goshen Health Notifies 9, 160 Patients of Historic PHI Breach

[Destry Winant]

https://www.hipaajournal.com/goshen-health-notifies-9160-patients-of-historic-phi-breach/

Goshen Health in Indiana has started notifying 9,160 patients that
some of their protected health information (PHI) may have been
compromised in a phishing-related email breach in August 2018.

Upon discovery of the breach the compromised email accounts were
secured and the breach was investigated. At the time, the security
breach was determined not to require notifications to patients as PHI
did not appear to have been compromised. However, on August 1, 2019,
Goshen Health became aware that the compromised email accounts did
contain the PHI of certain patients and notification letters were
necessary.

The breach occurred between August 2, 2018 and August 13, 2018. An
unidentified, unauthorized individual gained access to the email
accounts of two Goshen colleagues. Following the breach, Goshen Health
enhanced its email security protections and as part of that process
used additional forensic tools and technology to re-evaluate the
breach.

Third-party forensics experts were retained in November 2018 to
reassess the incident, but no evidence of unauthorized PHI access or
PHI theft was uncovered. Part of the evaluation involved a detailed
search of the compromised email accounts to determine whether they
contained any sensitive patient information. Almost a year to the day
after the first account compromise, the accounts were contained to
contain the PHI of certain patients.

The PHI in the accounts included names, addresses, dates of birth,
health insurance information, physicians’ names, Social Security
numbers, driver’s license numbers, and limited clinical information.

The breach was reported to the HHS’ Office for Civil Rights on
September 30, 2019 and notification letters were sent to affected
patients the same day. Individuals whose Social Security number or
driver’s license number were exposed have been offered 12 months of
complimentary credit monitoring and identity theft protection
services.

Further training has now been provided to staff members related to
email security and phishing awareness.