HIPAA Horror Stories

Employees Fall Prey to Phishing

one-minute read

Be more skeptical on the internet. Medical identity theft is extremely profitable for cyber criminals and it’s all too easy with basic phishing tactics. It shouldn’t be.

Getting caught in a phisher’s net can happen to anyone. Recently four employees at Michigan Medicine (University of Michigan Health) fell for a phishing scam and the protected health information (PHI) of 33,850 individuals was exposed. Like many us, the employees were too trusting and followed the criminal phisher’s instructions to give away the keys – their email login information.

As Michigan Medicine explained in its breach notice on October 27, 2022:

“…the attacker lured employees to a webpage designed to get them to enter their Michigan Medicine login information. Four Michigan Medicine employees entered their login information and then inappropriately accepted multifactor authentication prompts which allowed the cyber attacker to access their Michigan Medicine e-mail accounts.”

The emails were job-related communications for patient care and coordination and contained personal information, including names; medical record numbers; addresses; dates of birth; diagnostic and treatment information; and/or health insurance information. The amount and type of information varied by patient.

Two Phishing Incidents this Year

Unfortunately, this latest incident looks similar to one Michigan Medicine reported in March, 2022. In that case a cyber attack through phishing compromised an employee’s email in December, 2021, was discovered in January, 2022, and the PHI of almost 3,000 patients was compromised.

Phishing is a HIPAA Problem

When PHI is compromised by a cyber attack, it becomes a healthcare data breach that must be reported to the Office for Civil Rights (OCR) under the Breach Notification Rule. Michigan Medicine has also notified patients individually and posted a public notice, both required by HIPAA.

OCR will investigate to find out whether Michigan Medicine is complying with HIPAA, whether it has a HIPAA risk analysis – risk management plan, and whether its employees are trained.

Cybersecurity Awareness Training

Most criminal cyber attacks still succeed with simple phishing tactics. It’s true that cyber crime has skyrocketed and some of it is extremely sophisticated designed to pierce through hi-tech defenses. But criminals also use basic tricks to fool unsuspecting staff. People can’t be programmed the way a piece of code defending your network can. On the other hand, people can learn more with basic cybersecurity awareness training.

Cybersecurity awareness training is essential. It’s not technical or expensive and it helps employees both at work and at home on their personal devices.

Training is Required for HIPAA Risk Management

The primary HIPAA requirement – the first compliance priority and strongest defense against medical identity theft – is a full HIPAA risk analysis and risk management program. Training is part of risk management because it helps staff defend, push back and keep the network doors locked. But a full risk analysis will address all the other ways PHI might be at risk, and guide you to create the safeguards HIPAA requires to keep PHI secure.

Don’t become a HIPAA Horror Story! HIPAA compliance is easy, when you know the rules.

Request A Demo

Copyright © 2023 ET&C Group LLC.

The HIPAA E-Tool® and Protecting Patient Privacy is Our Job®
are registered trademarks of ET&C Group LLC

Terms & Conditions | Privacy Policy | Cookies Policy | Privacy Settings | HTML/XML Sitemap

Mailing Address
The HIPAA E-Tool
PO Box 179104
St. Louis, MO 63117-9104

8820 Ladue Road Suite 200
St. Louis, MO 63124