A phishing attack on the employee email account of a worker for Port Townsend, Wash.-based Jefferson Healthcare may have exposed the personal information of thousands of patients late last year, according to a statement from the health system.
Four details:
1. The health system discovered unauthorized access to the account between Nov. 9 and Nov. 12.
2. The hacker did not access the health system's EHR, billing system or other IT systems.
3. After conducting an investigation, the health system said the breached email account contained information of 2,550 patients, including their names, birth dates, addresses, health insurance information and treatment information.
4. There was financial information and Social Security numbers for some patients within the breached email account.