Looking for a Business Associate Agreement? Download our FREE starter BAA template.

Total HIPAA Logo

Case Study- Hook, Line, and Sinker: Falling for a Phishing Scam

A HIPAA Prime client emailed and called us on a Tuesday afternoon to let us know that earlier that day their email had been hacked and a phishing email was sent out to over 1,000 contacts that included clients. 

The Total HIPAA Compliance Team immediately called them back to assist. 

They had already included their IT Vendor in the investigation. The IT Vendor, the client, and Total HIPAA recapped the situation and then came up with a plan of action. 

First, all of the contacts that received the phishing email needed to be contacted immediately to ensure the email was deleted and the link was not clicked on.

Second, the IT Vendor had to look through the logs to determine what systems were accessed to determine if PHI was accessed and therefore there was a breach of PHI. 

Total HIPAA immediately wrote this email to have our client send to the affected individuals: 

Subject: Investigation into Phishing Link Sent

Dear [Recipients],
It has come to our attention that a link was sent out to you at [Insert time], which turned out to be part of a phishing scam.

As soon as we became aware of the issue, we took immediate steps to investigate the matter.
Please do not click on the link, and delete the email if you have not already.

We take the security and privacy of our clients very seriously, and we are committed to ensuring that our systems are secure and protected.

If you have any questions or concerns, please do not hesitate to contact me.

Thank you for your understanding and cooperation.

[Your Name]

Total HIPAA continued working with the client and the IT Vendor to determine the extent of the hack. After a deep investigation by the IT vendor it was determined that the attacker gained access to an MFA token. As there is no PHI in the client’s email this attack was not a breach. If they would have gained access to the cloud server it would have been a HIPAA breach.

In response to the attack the IT Vendor,  implemented the following to closely monitor for suspicious activity:

  • Dark Web monitoring for credentials, network information, etc. related to the Total HIPAA Client
  • Added an additional Microsoft 365 license to the environment which allows for more granular control over who/how individuals can access the tenant (geo-location-based restrictions, etc.)
  • I’ll be rolling out an AI based Phish/Spam/Malware application to O365 this week to mitigate risk of a repeat incident.

Once it was determined that it was not a Breach of PHI Total HIPAA created the following to send to those affected: 

Subject: Investigation Results – No Evidence of Downloaded Content from Phishing Incident

Dear [Recipients],
Following the phishing incident, our IT department conducted a thorough investigation. 

I am pleased to inform you that based on the results, there is no evidence that any data was compromised. Our IT department has taken all the necessary steps to ensure our systems and accounts are secure. We will continue to monitor them closely to prevent future incidents.

I want to remind everyone to remain vigilant and cautious when receiving emails, especially those that contain links or attachments. If you receive an email that looks suspicious, please report it to your IT department immediately.

Once again, I apologize for any inconvenience caused and thank you for your cooperation and patience during the investigation. Please do not hesitate to contact us with any questions or concerns.

Thank you.
[Your Name]

Once it was determined it was an incident and not a breach, Total HIPAA also assisted the client in documenting the investigation on the Total HIPAA Breach Analysis Worksheet. This worksheet along with any documentation from the IT Vendor needs to kept for 6 years. 

“We are very happy with the results that we have not had a breach with this phishing email incident. We appreciate the template emails you provided, so we could send important information and updates to the people that received the email, and help guide us through this process.”

Quote From Client

Total HIPAA specializes in HIPAA compliance services, helping businesses adhere to HIPAA guidelines and protect sensitive data. Our experts ensure your organization remains compliant with HIPAA regulations, meaning you can focus on your core operations while we handle documenting the policies and procedures that make up your HIPAA compliance plan. Trust Total HIPAA for comprehensive compliance solutions tailored to your needs. Book a clarity call today.

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)