Catawba Valley Medical Center

In August 2018, the covered entity (CE), Catawba Valley Medical Center, discovered that an unauthorized person gained access to the email accounts of three employees via a phishing attack. The CE scanned all the emails potentially affected and determined that 22,952 individuals’ protected health information (PHI) may have been compromised, including demographic and health insurance information. Following the breach, the CE changed the passwords on the affected accounts and set up additional system activity monitoring. The CE implemented a multifactor authentication requirement, provided additional training to staff members related to phishing attacks, and activated a software plugin that assists in reporting suspicious emails to the CE’s service desk. The CE provided breach notification to HHS, affected individuals, and the media and posted notice on its website. OCR provided technical assistance to the CE related to the Security Rule and phishing attacks and obtained assurances that the CE implemented the corrective actions listed above.