HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Feb. 1, 2018.
- Organization as reported
- Forrest General Hospital, MS
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Feb. 1, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13928, row:5067)
- Archived copy
- Held in the private archive (provenance)
Horne CPAs & Business Advisors, a business associate (BA) of Forrest General Hospital (CE), discovered that a staff member’s email account was sending out suspicious emails after being compromised in a phishing attack. The BA investigated the incident, and determined that an email attachment to one of the emails in the compromised account contained the protected health information (PHI) of 1,671 of the CE’s patients. The types of breached PHI included names, Medicaid numbers, dates of service, dates of birth, patient account numbers, and Social Security numbers. The BA notified the CE, and worked with the CE to meet the requirements of the Breach Notification Rule. The BA provided breach notification to the affected individuals and the media. The CE provided notice to HHS and on its website. The BA sanctioned the employee involved and, in response to this incident and OCR’s investigation, the BA implemented several technical security improvements. OCR obtained assurances that the CE implemented the corrective actions listed above.