New York Oncology Hematology in Albany mailed letters to all of its patients and employees notifying them that some of their protected health information may have been accessed as the result of an email phishing attack.
The attack occurred between April 20 and April 27, during which an unauthorized third party used phishing tactics to obtain several employees' email login credentials and gain access to their email accounts. An investigation revealed one or more of the affected accounts contained PHI and other personal information of patients or employees.
Although NYOH doesn't have evidence that its patients' or employees' information has been misused, the center has notified and provided 12 months of credit reporting services to its more than 128,400 patients and employees, according to The Record. Patients and employees who joined NYOH after April 27 were not affected.
"We deeply regret any inconvenience or concern this incident may cause our patients and employees," reads a notice on the organization's website. "We are taking precautionary steps to ensure patient safety, privacy and peace of mind. To help prevent something like this from happening again, NYOH will continue to look for ways to enhance our systems, training and controls against these threats."