CHI - Lakewood Health

On December 12, 2018, the covered entity (CE), CHI-Lakewood, discovered that a third party obtained login credentials to access an employee’s email account, which contained the protected health information (PHI) of 885 individuals, and used the account to send spam email. The CE provided breach notification to HHS, affected individuals, and the media. The CE forcibly changed the compromised account password within 45 minutes of discovering the incident, and upon investigation learned that the employee’s password contained common words and could be easily determined or may have been used by the employee outside of the CE. Following the breach the CE implemented technical safeguards including access controls, two-factor authentication, and a virtual private network (VPN) for remote use. The CE coached and retrained the involved employee and retrained all staff on developing and safeguarding strong passwords and email maintenance by utilizing multiple mediums such as posters, memos, newsletters, and handouts. OCR obtained documented assurances that the CE implemented the corrective actions steps listed above.