AU Medical Center, Inc.

On September 7, 2016, a cyber-attacker sent a phishing email to the covered entity (CE), Augusta University Medical Center, Inc. and obtained employees' user names and passwords. The cyber-attacker then accessed the employees’ self-service portal with the purpose of redirecting their paychecks to the cyber-attacker’s bank account. The breach affected the protected health information (PHI) of 4,690 individuals and included one or more of the following: addresses, dates of birth, medical record numbers, insurance information, prescription information, treatment information, and for a few individuals, social security numbers. In response to this incident, the CE changed user passwords, closed affected email accounts, and issued a security alert for all staff members to immediately change their passwords. The CE provided breach notification to HHS, affected individuals, and the media. It also established a dedicated call center and one year of free credit monitoring for all affected individuals. The CE enhanced security by implementing two-factor authentication for remote connections, an e-mail subject tagging system, and a log collection and correlation tool. The CE provided additional training on spotting phishing emails, deployed a means to automatically quarantine suspicious email messages, and corrected its software to identify suspicious internet addresses more quickly. OCR confirmed that the CE implemented the corrective actions listed above.