Tift Regional Medical Center

Tift Regional Medical Center, the covered entity (CE), discovered that on June 20, 2018, an unknown individual gained access to two employee email accounts. A forensic investigation determined that the breach affected 1,045 individuals' protected health information (PHI) and included patients’ names, dates of birth, and clinical information such as lab results, treatments, and doctors’ notes. The CE provided breach notification to HHS, affected individuals, and the media. To prevent a similar breach from reoccurring, the CE retrained staff on detecting malicious emails and how to safeguard passwords. In response to OCR’s investigation, the CE added a new security feature on their removable devices that can detect and filter malicious links and attachments.