HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 7, 2018.
- Organization as reported
- InterAct of Michigan, Inc., MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Aug. 7, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13726, row:4865)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), InterAct of Michigan, Inc., reported that an employee was the victim of a phishing attack and an unauthorized individual gained access to the employee’s email account. The email account contained protected health information (PHI), including the names, addresses, dates of birth, treatment history, prescription information, and in some instances, social security numbers, of 1,290 individuals. The CE provided breach notification to HHS, the media, and the affected individuals. As part of the notification, the CE established a toll-free response line and provided twelve months of complimentary credit monitoring to individuals whose social security numbers were compromised. Following the breach, the CE changed the compromised employee’s account credentials, removed the email forwarding rule, and disabled forwarding to any external email addresses. In addition, the CE began reviewing logs on a weekly basis to better identity suspicious activity and turned off email web access for all users. The CE also installed new antivirus and phishing education software and retrained all workforce members on the importance of being vigilant when reviewing email. OCR obtained documentation that the CE implemented the corrective actions listed above.