The Albuquerque, N.M.-based integrated health system Presbyterian Healthcare Services is notifying more than 180,000 individuals that a phishing attack on its workforce members’ emails had occurred earlier this year.
A statement released on the health system’s website noted that on June 6, Presbyterian discovered that anonymous and unauthorized access was gained through a deceptive email to some of Presbyterian’s workforce members about a month earlier.
“Presbyterian believes that the unauthorized access to these email accounts was part of a phishing scam trying to get information. These email accounts included patient and/or health plan member names and might have contained dates of birth, Social Security numbers and clinical and/or health plan information. Once Presbyterian became aware of this incident, it secured these email accounts, began a thorough review of the impacted emails and alerted federal law enforcement,” officials said.
Presbyterian Healthcare Services is a private not-for-profit system in New Mexico, and owns and operates eight hospitals in seven New Mexico communities. It also operates Presbyterian Health Plan.
According to the HIPAA Journal, an analysis of the compromised email accounts revealed they contained the protected health information (PHI) of 183,370 individuals.
Presbyterian officials said they are not aware of any improper use, or attempted use of the individuals’ information, and that the breach did not affect its electronic health records or billing systems.
Some steps the health system is taking to improve its security measures going forward include annual mandated training for workforce members about the importance and requirement to safeguard all information. Specifically, workforce members have received, and will continue to receive, reminders about safeguarding information stored electronically and how to avoid phishing scams, officials said.
