Beaumont Health, which is the biggest healthcare system in Michigan, reported a likely exposure of patient information contained in emails and attachments as unauthorized individuals accessed the email accounts of a number of employees.
Beaumont Health found out about the breach of email account on March 29, 2020. The incident that transpired around 10 months ago brought about the compromise and potential patient data theft. Based on the breach investigation results, unauthorized individuals got access to the email accounts beginning May 23, 2019 until June 3, 2019. Forensic specialists looked into the breach to know the magnitude and scope of the breach, alongside a manual analysis of all emails in the breached accounts. It took some time to finish the breach investigation, therefore there was a delay in the issuance of breach notifications to the affected patients.
The investigators affirmed that the protected health information (PHI) of 112,000 persons was contained in the compromised email. The affected patients were around 5% of the 2.3 million Beaumont Health patients. The types of information exposed and might have been stolen by the threat actors were different from patient to patient. The compromised information included the name of patients as well as at least one of the following data elements: birth dates, diagnosis codes, diagnoses, kinds of treatment, procedures, treatment locations, prescription information, health record numbers. and internal patient account numbers The Social Security numbers including the other records of a number of patients were similarly potentially compromised. Though the forensic investigators affirmed that the threat actors accessed the email accounts, there was no way to make sure no data was viewed or stolen.
As a result of the breach, Beaumont Health provided more training to its employees so that they could recognize malicious and phishing email messages. Modification of internal policies was taken on and more technical security steps were set up to avoid other breaches from happening in the future.
This occurrence is the second reported data breach at Beaumont Health this year. The first incident was reported in January and involved the breach of PHI of 1,182 patients. A former hospital employee accessed the records of patients who got treatment after being injured in a car accident. Allegedly, the snooping employee shared the patient data with a personal injury attorney.