The email sent to employees appeared to be from a trusted source and contained a link to a fake login page. If staff entered their login information, hackers obtained access to the hospital’s system and that specific employee’s account.
Potentially compromised health data includes: patient names, medical record numbers, dates of hospital stays and procedures, diagnosis and conditions and other clinical information.
While the hospital posted a notification about the breach to its website in January, affected families in the area are still being notified via letter.
“Because the email accounts had a large amount of data that had to be evaluated, we have notified individuals in groups as we progressed through the process,” Children’s Mercy spokesperson Lisa Augustine told The Kansas City Star. “The hospital has taken and continues to take steps to protect against any further incidents. These steps have included the implementation of the additional technical control of multi-factor authentication.”
The hospital’s IT team discovered the unauthorized access to multiple employee email accounts in December 2017 and January 2018. The hospital is continuing its investigation into the incident and will continue to notify affected individuals and families.
The hospital is offering affected patients and family members one free year of identity theft protection.
More articles on cybersecurity:
3 major HIPAA fines so far in 2018
Report: New scam demands ransom payment — but does not deploy ransomware
MD Anderson slapped with $4.3M penalty for HIPAA violations
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
