Northwest Surgical Specialists

An employee who is not involved in patient care followed a link in a phishing email to a website and provided credentials allowing access to the employee’s email account on May 9, 2018. On May 22, 2018, upon discovering that an unknown individual gained access to the account and created unauthorized rules, the covered entity (CE) immediately notified its IT department. The CE also retained a computer forensic investigation firm that discovered that the compromised account’s activity could not be audited. The CE treated the incident as a breach of the employee’s entire email account and found that the email account contained protected health information (PHI) on August 8, 2018. The PHI involved in the breach included the names, addresses, dates of birth, social security numbers, claims information, lab results, and other treatment information of approximately 2,050 individuals. The CE provided breach notification to HHS, affected individuals, and the media, as well as substitute notice. Following the breach, the CE reset the password on the compromised account, disabled the rules that were created, and confirmed that no other email accounts were compromised. Additionally, the CE cre