Compromised Employee Email at MN Behavioral Health Center Allows Unauthorized Access

Who: Human Development Center

When: 22 Mar 2019

# of records involved: Undetermined

What happened: An employee’s email account was compromised and accessed by individuals outside HDC

How did it happen: During a routine review of email logs on Jan. 25, it was determined that an employee’s email account was compromised and accessed by individuals outside HDC. HDC believes the likelihood the information was accessed or downloaded within the emails was low

Outcome: Upon review of the information within the email account, protected health information consisting of client names, date of birth, internal HDC client numbers, internal HDC description of services and a limited number of procedure codes were found. HDC said it has investigated how the breach happened and has taken key steps to help manage inappropriate cybersecurity attacks in the future.