On October 23, 2018, The Children's Hospital of Philadelphia submitted a HIPAA Email Breach to the U.S. Department of Health and Human Services (HHS). Based in Philadelphia, Pennsylvania, The Children's Hospital of Philadelphia’s email breach affected 5,368 individuals’ protected health information. The Children's Hospital of Philadelphia is classified as a Healthcare Provider. According to this report about The Children's Hospital of Philadelphia’s breach:
Children’s Hospital of Philadelphia (CHOP) has discovered the email accounts of two employees have been compromised following successful phishing attacks on August 23 and August 29, 2018. On August 24, CHOP discovered an unauthorized individual had gained access to the email account of a one of its physicians. The investigation revealed the account was first accessed the previous day. Two weeks later, on September 6, CHOP discovered a second email account had also been compromised. In that case, access to the account was first gained on August 29. In both cases, prompt action was taken to secure the accounts and prevent further access. A leading computer forensics firm was also retained to assist with the investigation and assess the scope of the breach. An analysis of the email accounts revealed the individual(s) behind the phishing attacks may have been able to gain access to the protected health information (PHI) of a limited number of patients of CHOP’s neonatal and fetal programs. The information that was exposed differs from patient to patient and may have included a full name, birth date, and clinical information related to neonatal/fetal services received at Children’s Hospital of Philadelphia and, in a limited number of cases, the Hospital of the University of Philadelphia. No Social Security numbers or financial information were compromised at any point. While emails in the account were potentially accessed and ePHI may have been stolen, CHOP has not uncovered any evidence to suggest that patient information has been misused. Mothers and parents/legal guardians of current and former patients were notified of the breach by mail on October 23, 2018. Affected individuals have been advised to monitor statements from their healthcare providers for any signs of fraudulent activity. The breach report on the Department of Health and Human Services’ Office for Civil Rights breach portal indicates 5,368 individuals have been impacted by the phishing attacks.
The HHS Wall of Shame is a website under the jurisdiction of HHS that lists all HIPAA breaches reported within the last 24 months. The Wall of Shame displays breaches that are currently under investigation by the Office for Civil Rights. As part of section 13402(e)(4) of the HITECH Act, the HHS Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.
The Paubox HIPAA Breach Report analyzes breaches that affected 500 or more individuals as reported in the HHS Wall of Shame.