AU Medical Center, Inc.

About this report

On September 7, 2016, a cyber-attacker sent a phishing email to the covered entity (CE), Augusta University Medical Center, Inc. and obtained employees' user names and passwords. The cyber-attacker then accessed the employees’ self-service portal with the purpose of redirecting their paychecks to the cyber-attacker’s bank account. The breach affected the protected health information (PHI) of 4,690 individuals and included one or more of the following: addresses, dates of birth, medical record numbers, insurance information, prescription information, treatment information, and for a few individuals, social security numbers. In response to this incident, the CE changed user passwords, closed affected email accounts, and issued a security alert for all staff members to immediately change their passwords. The CE provided breach notification to HHS, affected individuals, and the media. It also established a dedicated call center and one year of free credit monitoring for all affected individuals. The CE enhanced security by implementing two-factor authentication for remote connections, an e-mail subject tagging system, and a log collection and correlation tool. The CE provided additional training on spotting phishing emails, deployed a means to automatically quarantine suspicious email messages, and corrected its software to identify suspicious internet addresses more quickly. OCR confirmed that the CE implemented the corrective actions listed above.

Summary as published by the HHS Office for Civil Rights.