Memorial Hospital at Gulfport

On December 4, 2018 an employee in the medical records department responded to a phishing email and provided their username and password credentials. On December 6, 2018, a routine system audit log uncovered nine outside logins to the covered entity’s system from an unauthorized individual who may have accessed 30,642 patient’s protected health information (PHI), including demographic and clinical information. IT personnel secured the email account and investigated the emails within the compromised account. Following the incident, the CE implemented a multi-factor authentication requirement and trained staff on phishing. On February 15, 2019, the CE provided breach notification to HHS, the affected individuals, and to the media. OCR obtained assurances that the CE implemented the corrective actions listed above.