DNA Diagnostics Center (DDC), one of the largest private DNA testing laboratories in the United States, has been fined a total of $400,000 by state attorneys general in Pennsylvania and Ohio for violations of state laws that contributed to a breach of the personal information of almost 46,000 Pennsylvania and Ohio residents, and approximately 2.1 million individuals across the United States.

The data breach that prompted the investigation was discovered by DDC on August 6, 2021, when suspicious activity was detected in some of its archived databases. The investigation determined the databases had been accessed by unauthorized individuals between May 24 and July 28, 2021, and certain files and folders had been removed. The databases contained the sensitive information of individuals who had received DNA testing services between 2004 and 2012, including 33,300 individuals in Pennsylvania and 12,600 individuals in Ohio. The information included sensitive customer information including names, Social Security numbers, and payment information.

The databases had been obtained from a company called Orchid Cellmark, which DDC acquired in 2012. The databases had been archived and were not used for any business purposes and, according to DDC, were inadvertently transferred as part of the acquisition, without the knowledge of DDC. Nine years after the acquisition, DDC was still unaware that the databases existed in its systems. DDC said it had conducted penetration tests and an inventory assessment prior to the data breach occurring, but those assessments and tests only identified active customer data and did not reveal the presence of the archived databases on its systems.

Prior to the data breach, DDC contracted with a third-party service provider to conduct data breach monitoring. That company detected the data breach and attempted to contact DDC on multiple occasions via automated email alerts, but employees failed to respond for two months. During those two months, malware – Cobalt Strike – was installed on the network and data was exfiltrated. The breach investigation confirmed that an unauthorized third party had logged on via a VPN on May 24, 2021, using a DDC user account. Active Directory credentials were harvested from a Domain Controller that provided password information for each account in the network. The VPN used by the threat actor was not in use at DDC, which had migrated to a new VPN. The unauthorized third party used a test account with admin privileges to achieve persistent access and execute Cobalt Strike within its network. Five servers were compromised that contained backups of 28 databases, and a decommissioned server was used to exfiltrate the data. The threat actor then contacted DDC and demanded payment for the return and deletion of the stolen data, and payment was made.

The investigation by the state attorneys general found DDC had “engaged in deceptive or unfair business practices by making material misrepresentations in its customer-facing privacy policy concerning the safeguarding of its customers’ personal information.” It was also alleged that DDC failed to employ reasonable measures to detect and prevent unauthorized access to its computer networks, and as such, engaged in unfair and deceptive cybersecurity practices which exposed customer data to unauthorized access and theft. The state AGs ruled that those failures constituted unfair trading practices and violations of state Consumer Protection Law.

DDC chose to settle the investigations with no admission of wrongdoing. Under the terms of the settlement, DDC agreed to pay $200,000 to Pennsylvania and $200,000 to Ohio, implement and maintain a comprehensive information security program, conduct comprehensive risk assessments at least annually, allocate risk-appropriate resources to protect the personal information of consumers, and conduct an information security program assessment at least annually to review the effectiveness of the information security program.

“The more personal information these criminals gain access to, the more vulnerable the person whose information was stolen becomes,” said Acting Attorney General Henry. “That’s why my Office took action with the assistance of Attorney General Yost in Ohio. I am proud of the work our agents and attorneys do every day to protect Pennsylvanians’ most sensitive information.”

The post State AGs Fine DNA Testing Lab $400,000 for Data Breach appeared first on HIPAA Journal.

Two Democratic U.S. Senators – Michael Bennett (D-CO) and Mazie Hirono (D-HI) – have introduced a bill that seeks to strengthen the privacy protections of the Health Insurance Portability and Accountability Act (HIPAA) for individuals seeking access to abortion care. The bill – The Secure Access for Essential Reproductive (SAFER) Health Act – was prompted by the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, which removed the federal right to abortions and gave individual states the full power to regulate any aspect of abortion care not protected under federal law.

The senators are concerned that while patient privacy is protected under HIPAA, HIPAA permits healthcare providers to disclose patient information for legal investigations without patient consent, which means the sensitive health information of individuals seeking access to abortion care could be disclosed to law enforcement to allow those individuals to be prosecuted for attempting to terminate pregnancies.

In June 2022, in response to the Supreme Court decision, the Department of Health and Human Services issued guidance to HIPAA-covered entities and their business associates confirming that while the HIPAA Privacy Rule permits disclosures of protected health information, as required by law, without individual authorizations, the HIPAA Privacy Rule does not require such disclosures. The HHS also confirmed that disclosures of reproductive health information are also only permitted in very limited circumstances, and encouraged anyone who believes their privacy has been violated to file a complaint with OCR.

The SAFER Health Act seeks to improve protections further and prohibit healthcare professionals from sharing personal health information related to the termination or loss of pregnancy with the courts without a valid authorization from the patient and, if passed, would apply to federal, state, local, and tribal proceedings, including civil, criminal, administrative, and legislative proceedings. The Act calls for the HHS to revise HIPAA and health information technology regulations accordingly to allow the enforcement of this new requirement, and to conduct a national campaign to educate HIPAA-covered entities and their business associates about the revisions.

“No one should have to worry about being investigated or prosecuted for receiving or providing reproductive health care,” said Bennet. “This legislation will protect the privacy of patients who have had abortions, regardless of where they live or receive care.” Bennett, along with other Democratic senators, introduced the Freedom to Travel for Health Care Act in July 2022, to clarify that it is illegal for states that have implemented bans or restrictions on abortions to prohibit state residents from traveling across state lines to receive abortion care. Bennet was also one of several Democratic Senators to introduce the Let Doctors Provide Reproductive Health Care Act, which sought to protect doctors that provided legal abortions to out-of-state patients; however, both Acts failed to make it past the Senate.

“MAGA Republicans in states with abortion bans have made it very clear they want to prosecute women for seeking reproductive health care. One way they plan to do that is by weaponizing patients’ reproductive health information,” said Senator Hirono. “That is why I am proud to introduce the SAFER Health Act—legislation that would strengthen and expand HIPAA to protect women and ensure doctors cannot share personal reproductive health information to a court proceeding without patient consent.

The post Democratic Senators Propose Update to HIPAA to Ban Abortion-Related PHI Disclosures Without Patient Consent appeared first on HIPAA Journal.

A bipartisan group of senators has written to three telehealth companies demanding answers about the use of third-party tracking technologies on their websites and details of the sensitive health data that they share with third parties such as Meta, Google, and social media networks.

In the summer of 2022, The Markup/STAT conducted an investigation into the use of tracking technologies on the websites of U.S. hospitals and found that around one-third of the hospitals investigated had these technologies on their websites. Website tracking code could capture and transmit identifiable health information to third parties, which could be further disclosed and used for targeted advertising. In December 2022, a similar investigation was conducted on the use of the code by telehealth companies. The investigation revealed 49 out of the 50 telehealth websites they investigated were sharing consumer data with third parties through pixels and other website tracking technologies, despite the companies maintaining that any information disclosed to them by consumers would be kept private and confidential.

Maria Cantwell (D-WA), Chair of the Senate Commerce Committee, Amy Klobuchar of (D-MN), Susan Collins (R-ME), and Cynthia Lummis (R-WY) wrote Cerebral in California, Monument in New York, and Workit Health in Michigan about these disclosures. The senators say the telehealth industry has been valued at over $30 billion and has allowed Americans to get easy access to the care they need, especially individuals in rural communities with limited physical access to healthcare facilities. However, the convenience of telehealth should not be at the expense of privacy and sensitive health information should not be exposed to the world’s largest advertising ecosystem.

Cerebral operates a website that was used by more than 200,000 patients in 2020 and 2021. Users of its website are asked to complete medical questionnaires, which include questions about medical conditions such as depression, anxiety, and bipolar disorder. That information, along with details of the medications they purchase through the website, is sent to third parties who can monetize that information. Website users are told that their health data will remain private and confidential and were not informed about these disclosures.

Workit Health’s website was used by more than 20,000 individuals in 2021. Its users were similarly asked to complete medical questionnaires, including questions about substance use and mental health, and that information was discovered to have been shared with platforms such as Google and Facebook along with identifiable information. Workit Health stated on its website that any information shared by users would be kept private and would be protected by its HIPAA-compliant software

Monument’s website was used by more than 30,000 patients in 2021. Users of the website were asked questions about mental health and alcohol use. Monument claims on its website that consumers’ health information is kept 100% confidential and that Monument is HIPAA compliant but The Markup/STAT investigation revealed information was being shared with platforms such as Google and Facebook without the knowledge of website users.

The senators asked the telehealth companies to provide a list of all questions consumers may be asked, the types of information that are shared with third parties, and whether information has ever been shared with a third party that would allow an individual to be identified as seeking treatment for a specific mental health or substance abuse condition. They also asked the companies to commit to protecting patient privacy and informing patients, in clear, easy-to-understand, plain language, the exact types of information that will be shared with third parties and for what specific purposes.

Last year, the Department of Health and Human Services’ Office for Civil Rights (OCR) issued guidance to HIPAA-regulated entities on the use of website tracking technologies. OCR confirmed that HIPAA-covered entities are not permitted to share protected health information via these tracking technologies unless consent to do so is obtained from individuals in advance, or if the provider of the technology is a HIPAA business associate, a valid business associate agreement is in place, and the disclosure is expressly permitted by the HIPAA Privacy Rule.

The Federal Trade Commission is also taking an interest in the use of these tracking technologies on health apps and websites and recently announced its intention to fine GoodRx, a provider of discounts for medications and telehealth services, $1.5 million for violations of the FTC Health Breach Notification Rule. GoodRx is alleged to have failed to notify consumers that their health information had been disclosed to third parties such as Facebook and Google after claiming users’ health data would be kept private.

The post Senators Demand Answers from Telehealth Firms on Pixel-Related Data Sharing Practices appeared first on HIPAA Journal.