Community Psychiatric Clinic

Community Psychiatric Clinic reported to HHS on 2019-08-15 a Hacking/IT Incident affecting 5,866 individuals. Breached information located on Email. The incident involved an email phishing scheme that exposed ePHI including names, SSNs, addresses, diagnoses, lab results, medications, and financial data. The clinic retrained staff and implemented technical safeguards.

Community Psychiatric Clinic reported to HHS on 2019-08-15 a Hacking/IT Incident affecting 3030 individuals. Breached information located on Email. The incident involved an email phishing scheme that exposed electronic protected health information (ePHI), including names, SSNs, addresses, birthdates, diagnoses, lab results, medications, claims, and financial data. The clinic retrained staff on identifying fraudulent emails and implemented additional technical safeguards.

Community Psychiatric Clinic (WA) reported to HHS on 2019-08-15 a Hacking/IT Incident affecting 6,641 individuals. The CE was the victim of an email phishing scheme compromising ePHI including names, Social Security numbers, addresses, birthdates, diagnoses/conditions, lab results, medications, claims information, and financial data. Following OCR investigation, the CE retrained workforce on identifying fraudulent emails and implemented additional technical safeguards. Breached information located in Email systems.

Community Psychiatric Clinic (CPC) notified the Washington AG of two security incidents involving unauthorized access to employee Office365 accounts. The first occurred on March 12, 2019; the second on May 8, 2019, involving a fraudulent wire transfer attempt. Access was via Outlook Web. Data potentially exposed included names, DOBs, SSNs, diagnosis/treatment info, and financial data. 6,600 Washington residents notified. CPC engaged forensic investigators, reset passwords, and offered 12 months of credit monitoring.

Community Psychiatric Clinic notified individuals of a multi-stage phishing incident in March and May 2019 compromising four Office365 accounts. Unauthorized access may have exposed PHI, SSNs, and financial data. The clinic changed passwords, engaged forensic investigators, and offered 12 months of credit monitoring. No data exfiltration was confirmed.