Insider Breach, Email Attacks Net $1.7M in HIPAA Fines, P3
- Shidonna Raven
- Jul 2
- 2 min read
December 6, 2024
Source: Bank Info. Security
Photo / Image Source: Unsplash,
Children's Hospital Breaches
HHS OCR said it investigated Children’s Hospital Colorado following reported breaches involving a phishing attack that compromised an email account containing 3,370 individuals’ PHI in 2017 - and another breach in 2020 involving the compromise of three employee email accounts containing 10,840 individuals’ PHI.
The agency said its investigation determined that the first reported breach occurred because multifactor authentication was disabled on an email account.
The second breach occurred, in part, when workforce members gave permission to unknown third parties to access their email accounts.
During its investigation, OCR also found violations related to the hospital's failure to train workforce members on the HIPAA Privacy Rule, and the HIPAA Security Rule requirement to conduct a compliant risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems.
"Email continues to be a very common way for cyberattackers to enter health information systems and jeopardize privacy and security,” Fontes Rainer said in a statement.
“Healthcare entities should identify potential risks and vulnerabilities to email accounts and train their workforce to protect health information in those accounts."
HHS OCR in June 2024 issued a notice of proposed determination seeking to impose a civil money penalty against the pediatric facility. Children’s Hospital Colorado waived its right to a hearing and did not contest OCR's findings.
Children's Hospital Colorado did not immediately respond to ISMG's request for comment.
How can such practices impact your health? How Why?
Share the wealth of health with your friends and family by sharing this article with 3 people today.
If this article was helpful to you, donate to the Shidonna Raven Garden and Cook E-Magazine Today. Thank you in advance.
Comments