South Texas Health System patient information may have been accessed in phishing attack

South Texas Health System in Edinburg said Wednesday that patients’ health information may have been accessed due to a phishing attack.

In a news release Wednesday, STHS said letters were mailed the same day informing patients who may be affected. 

The health system said a business associate learned on Jan. 18 of what STHS called “suspicious email activity in an authorized user’s email account” that occurred earlier that month.

“(O)n or about January 9, 2023, this user’s email account had been accessed without authorization as a result of a phishing incident,” the release stated.

Account credentials were reset at the time and an investigation was launched. The email account in question was accessed via a web browser and “certain emails” may have been accessed by “the unauthorized person,” STHS said.

However, the release further read that “there is currently no evidence” suggesting that patients’ protected health information was targeted “or otherwise copied or misused in any way.”

“Nevertheless, an extensive effort was made to match patient information in the emails with available mailing addresses in our system, and our Facility is providing notice of the incident to impacted patients in an abundance of caution and so they can take steps to protect their information if they find it appropriate to do so,” the release stated.

The emails that may have been impacted contain patients’ full names, account or medical record numbers as well as admission and discharge dates, diagnoses and discharges. Information may have also included billing amounts.

STHS said social security numbers were not included nor were credit card numbers or other financial information, “and generally did not include any email, phone number, or mailing address.”

Additional security measures have been implemented, as well as training, since the phishing attack.

“While our Facility is unaware of any actual or attempted misuse of (protected health information), we are offering impacted patients 12 months of identity surveillance and restoration services at no charge,” STHS said.

Through Aug. 31, a toll free number is active for residents seeking more information at (800) 984-9630. Call anytime between 8 a.m. and 10 p.m. Monday through Friday, or from 10 a.m. to 7 p.m. Saturday and Sunday for more information.