HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 31, 2019.
- Organization as reported
- CHI - Lakewood Health, MN
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Jan. 31, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13548, row:4687)
- Archived copy
- Held in the private archive (provenance)
On December 12, 2018, the covered entity (CE), CHI-Lakewood, discovered that a third party obtained login credentials to access an employee’s email account, which contained the protected health information (PHI) of 885 individuals, and used the account to send spam email. The CE provided breach notification to HHS, affected individuals, and the media. The CE forcibly changed the compromised account password within 45 minutes of discovering the incident, and upon investigation learned that the employee’s password contained common words and could be easily determined or may have been used by the employee outside of the CE. Following the breach the CE implemented technical safeguards including access controls, two-factor authentication, and a virtual private network (VPN) for remote use. The CE coached and retrained the involved employee and retrained all staff on developing and safeguarding strong passwords and email maintenance by utilizing multiple mediums such as posters, memos, newsletters, and handouts. OCR obtained documented assurances that the CE implemented the corrective actions steps listed above.