In Kentucky, Baptist Health Louisville recently informed 880 patients of a phishing attack.
The U.S. Department of Health and Human Services was also informed about the occurrence.
After conducting a comprehensive investigation and immediately shutting down the employee's email accounts and changing the passwords, Baptist Health was unable to completely exclude the possibility that the employee's communications had been seen by an unauthorised third party.
The affected employee's email accounts were then examined by Baptist Health, which confirmed that some of the emails did indeed contain patient information.
The compromised information includes names, dates of birth, medical record numbers, treatment and/or clinical information, and in some cases, Social Security numbers.
A free year of credit monitoring and identity protection is being made available to patients whose Social Security numbers may have been at risk.
"id": "BAP0106323",
"linkid": "baptist-health-louisville",
"type": "Data Leak",
"date": "12/2017",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"