Confluence Health

A Confluence Health employee received and responded to a phishing email on March 29, 2018. An unauthorized entity accessed the employee’s email account from a Nigerian internet address on March 30, 2018, and again on May 28, 2018, sent phishing emails to multiple recipients, and entered a setting to automatically delete all sent emails. The employee’s email account contained protected health information (PHI), including approximately 32,821 patients’ names and treatment information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. Following the breach, the CE disabled the compromised email account, blocked certain internet addresses, and required a password reset of all its computer network accounts. Additionally, the CE created alert notifications for access to accounts, enabled anti-phishing protections for its email system, heightened its reviews of network activity, implemented multi-factor authentication, and disabled certain types of access from outside its network. OCR provided technical assistance regarding the CE’s security management process.