Cancer Treatment Centers of America at Southeastern Regional Medical Center in Atlanta began notifying 3,290 patients that their personal health information may have been exposed in a security incident.
On July 29, CTCA discovered suspicious activity on an employee's email account. Upon investigation, the cancer center determined that an employee had fallen victim to a phishing attack that gave a hacker access to the account between July 22-30.
Patient data stored in the email included names, phone numbers, addresses, dates of birth, medical record numbers, health insurance information and/or medical information. No Social Security numbers or financial information was affected.
"We take our responsibility to safeguard personal information seriously and remain committed to protecting patient privacy and security. We are implementing security enhancements and continuing to educate our workforce about how to identify suspicious emails to help ensure this does not happen in the future," a statement from CTCA said.