HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 26, 2017.
- Organization as reported
- AU Medical Center, Inc., GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- May 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14180, row:5319)
- Archived copy
- Held in the private archive (provenance)
On September 7, 2016, a cyber-attacker sent a phishing email to the covered entity (CE), Augusta University Medical Center, Inc. and obtained employees' user names and passwords. The cyber-attacker then accessed the employees’ self-service portal with the purpose of redirecting their paychecks to the cyber-attacker’s bank account. The breach affected the protected health information (PHI) of 4,690 individuals and included one or more of the following: addresses, dates of birth, medical record numbers, insurance information, prescription information, treatment information, and for a few individuals, social security numbers. In response to this incident, the CE changed user passwords, closed affected email accounts, and issued a security alert for all staff members to immediately change their passwords. The CE provided breach notification to HHS, affected individuals, and the media. It also established a dedicated call center and one year of free credit monitoring for all affected individuals. The CE enhanced security by implementing two-factor authentication for remote connections, an e-mail subject tagging system, and a log collection and correlation tool. The CE provided additional training on spotting phishing emails, deployed a means to automatically quarantine suspicious email messages, and corrected its software to identify suspicious internet addresses more quickly. OCR confirmed that the CE implemented the corrective actions listed above.