Healthcare Data Privacy

$200,000 Penalty for Impermissible Sharing of Premom App Users’ Health Data

Posted by HIPAA Journal

Easy Healthcare, the developer and distributor of the Premom Ovulation Tracker (Premom) app, has agreed to settle an FTC complaint that alleged violations of the FTC Act and Health Breach Notification Rule related to the sharing of app users’ health data with third parties without consent.

The Premom app allows users to track their periods and ovulation cycles. The app allows users to upload pictures of ovulation test strips that the app analyses to predict the user’s next ovulation cycle and the app allows users to upload health data from other devices and apps. The app has been downloaded by hundreds of thousands of women, and between 2017 and 2020, the terms and conditions of use stated, “We do not, and will not, ever sell any information about users’ health to third parties, nor do we share it for advertising purposes.” During that period, the FTC alleged the Premom app transmitted the sensitive health information of app users to third-party advertisers without user consent.

The FTC’s Health Breach Notification Rule ensures entities not covered by the Health Insurance Portability and Accountability Act (HIPAA) face accountability for breaches of consumers’ sensitive health data. The Rule requires notifications to be issued to consumers when there has been a breach of individually identifiable health information, and in September 2021, the FTC issued a policy statement confirming that developers of health apps have a responsibility to secure any collected health data and must prevent unauthorized access.

According to the FTC complaint, Easy Healthcare told app users that their health data would not be shared with third parties without their knowledge or consent and falsely claimed the information it shared with third parties was non-identifiable, and would only be used for internal analytics. The FTC found that since 2018, Easy Healthcare shared Premom user data with Google LLC and the marketing firm AppsFlyers Inc, and between 2018 and 2020, Premom user data was shared with two Chinese mobile analytics companies – Jiguang (aka Aurora Mobile Ltd) and Umeng, and no effort was made by Easy Healthcare to restrict the uses of users’ health data by those companies. As such, the companies could use the data for a broad range of purposes, including advertising. In addition to health data, numbers unique to each mobile device (IMEI numbers) were also shared, along with precise geolocation data. The data sharing only stopped when the Google Play Store informed Easy Healthcare that the data sharing violated Play Store policies.

The FTC determined that Easy Healthcare failed to implement reasonable privacy and data security measures, in violation of the FTC Act. The disclosures meant Easy Healthcare was required to notify app users, the FTC, and the media. The FTC determined that timely and proper notice was not provided, in violation of the Health Breach Notification Rule. “Premom broke its promises and compromised consumers’ privacy,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection. “We will vigorously enforce the Health Breach Notification Rule to defend consumer’s health data from exploitation. Companies collecting this information should be aware that the FTC will not tolerate health privacy abuses.”

If the order is approved by the court, Easy Healthcare will pay a civil monetary penalty of $100,000 to the Treasurer of the United States. A $100,000 settlement was also agreed with the states of Connecticut, Oregon, and the District of Columbia, which assisted the FTC with the investigation. “Given the intimate health data that apps like Premom collect and what that may reveal about when a pregnancy starts or stops, it is critical that user information is kept safe and private,” said Attorney General Tong. “Our settlement forces Easy Healthcare to adopt strict privacy requirements to ensure that its users’ information is appropriately protected.”

Easy Healthcare has also been ordered to cease sharing personal health data with third parties for advertising purposes and must contact the third parties that were sent user data and request that information is deleted.  Easy Healthcare has also agreed to make improvements to its privacy and security practices and conduct regular privacy and security audits.

Easy Healthcare agreed to settle the case with the FTC to avoid the time and expense of litigation, and the decision to settle is not an admission of wrongdoing. “Rest assured that we do not, and will not, ever sell any information about users’ health to third parties, nor do we share it for advertising purposes. At Easy Healthcare, we adhere to the promises we make to our users. Protecting users’ data is a high priority, which is why we have always been transparent with and cooperated fully throughout the FTC’s review of our privacy program. We remain committed to these principles,” said Easy Healthcare in a statement.

The post $200,000 Penalty for Impermissible Sharing of Premom App Users’ Health Data appeared first on HIPAA Journal.

What is Considered PHI Under HIPAA?

Posted by HIPAA Journal

In a healthcare environment, you are likely to hear health information referred to as protected health information or PHI, but what is considered PHI under HIPAA? PHI is defined as different things by different sources. Some define PHI as patient health data (it isn´t), as the 18 HIPAA identifiers (it´s not those either), or as a phrase coined by the HIPAA Act of 1996 to describe identifiable information in medical records (close – except the term Protected Health Information was not used in relation to HIPAA until 1999).

What is Really Considered PHI Under HIPAA Rules?

To best explain what is really considered PHI under HIPAA compliance rules, it is necessary to review the definitions section of the Administrative Simplification Regulations (§160.103) starting with health information. According to this section, health information means any information, including genetic information, whether oral or recorded in any form or medium, that:

“Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.”

From here, we need to progress to the definition of individually identifiable health information which states “individually identifiable health information […] is a subset of health information, including demographic information collected from an individual [that] is created or received by a health care provider, health plan, employer, or health care clearinghouse […] and that identifies the individual or […] can be used to identify the individual.”

Finally, we move onto the definition of protected health information, which states “protected health information means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium”.

More about what is Considered PHI under HIPAA

To simplify a definition of what is considered PHI under HIPAA: health information is any information relating a patient´s condition, the past, present, or future provision of healthcare, or payment thereof. It becomes individually identifiable health information when identifiers are included in the same record set, and it becomes protected when it is transmitted or maintained in any form (by a covered entity).

Generally, HIPAA covered entities are limited to health plans, health care clearinghouses, and healthcare providers that conduct electronic transactions for which the Department of Health and Human Services (HHS) has published standards. The standards can be found in Subparts I to S of the HIPAA Administrative Data Standards. Therefore:

  • “A broken leg” is health information.
  • “Mr. Jones has a broken leg” is individually identifiable health information.
  • If a covered entity records “Mr. Jones has a broken leg” the health information is protected.

Where do Business Associates Enter the Equation?

As well as covered entities having to understand what is considered PHI under HIPAA, it is also important that business associates are aware of how PHI is defined. This is because any individually identifiable health information created, received, maintained, or transmitted by a business associate in the provision of a service for or on behalf of a covered entity is also protected.

Business associates are required to comply with the Security and Breach Notification Rules when providing a service to or on behalf of a covered entity. However, depending on the nature of service being provided, business associates may also need to comply with parts of the Administrative Requirements and the Privacy Rule depending on the content of the Business Associate Agreement.

When is PHI not PHI?

There is a common misconception that all health information is considered PHI under HIPAA, but this is not the case.

First, it depends on whether an identifier is included in the same record set. Under HIPAA, PHI ceases to be PHI if it is stripped of all identifiers that can tie the information to an individual. If identifiers are removed, the health information is referred to as de-identified PHI. HIPAA does not apply to de-identified PHI, and the information can be used or disclosed without violating any HIPAA Rules.

Health information is also not PHI when it is created, received, maintained, or transmitted by an entity not subject to the HIPAA Rules. For example, even though schools and colleges may have medical facilities, health information relating to students is covered by the Family Educational Rights and Privacy Act (FERPA) which classifies students´ health information as part of their educational records.

Health information maintained by employers as part of an employee´s employment record is not considered PHI under HIPAA. However, employers that administer a self-funded health plan do have to meet certain requirements with regards to keeping employment records separate from health plan records in order to avoid impermissible disclosures of PHI.

It is important to be aware that exceptions to these examples exist. One of the most complicated examples relates to developers, vendors, and service providers for personal health devices that create, collect, maintain, or transmit health information. Entities related to personal health devices are not covered entities or business associates under HIPAA unless they are contracted to provide a service for or on behalf of a covered entity or business associate.

However, entities related to personal health devices are required to comply with the Breach Notification Rule under Section 5 of the Federal Trade Commission Act if a breach of unsecured PHI occurs. This means that, although entities related to personal health devices do not have to comply with the Privacy and Security Rules, it is necessary for these entities to know what is considered PHI under HIPAA in order to comply with the Breach Notification Rule.

The complexity of determining if information is considered PHI under HIPAA implies that both medical and non-medical workforce members should receive HIPAA training on the definition of PHI. It is also important for all members of the workforce to know which standards apply when state laws offer greater protections to PHI or have more individual rights than HIPAA, as these laws will preempt HIPAA.

What is Considered PHI Under HIPAA FAQs

What are the 18 HIPAA Identifiers?

The 18 HIPAA identifiers are the identifiers that must be removed from a record set before any remaining health information is considered to be de-identified under the “safe harbor” method of de-identification (see §164.514). However, due to the age of the list, it is no longer a reliable guide. Since the list was first published in 1999, there are now many more ways to identify an individual,

Importantly, if a Covered Entity removes all the listed identifiers from a designated record set, the subject of the health information might be able to be identified through other identifiers not included on the list – for example, social media aliases, LBGTQ statuses, details about an emotional support animal, etc. Therefore, Covered Entities should ensure no further identifiers remain in a record set before disclosing health information to a third party (i.e., to researchers).

Also, because the list of 18 HIPAA identifiers is more than two decades out of date, the list should not be used to explain what is considered PHI under HIPAA – notwithstanding that any of these identifiers maintained separately from individually identifiable health information are not PHI in most circumstances and do not assume the Privacy Rule protections.

What is PHI under HIPAA?

PHI under HIPAA is individually identifiable health information that is collected or maintained by an organization that qualifies as a HIPAA Covered Entity or Business Associate. Additionally, any information maintained in the same designated record set that identifies – or could be used with other information to identify – the subject of the health information is also PHI under HIPAA.

What does PHI include?

PHI includes information about an individual´s physical or mental health condition, the treatment of that condition, or the payment for the treatment. Additionally, PHI includes any information maintained in the same record set that identifies – or that could be used to identify – the subject of the health, treatment, or payment information.

What are examples of PHI?

Examples of PHI include test results, x-rays, scans, physician’s notes, diagnoses, treatments, eligibility approvals, claims, and remittances. When combined with this information, PHI also includes names, phone numbers, email addresses, Medicare Beneficiary Numbers, biometric identifiers, emotional support animals, and any other identifying information.

Which format of PHI records is covered by HIPAA?

All formats of PHI records are covered by HIPAA. These include (but are not limited to) spoken PHI, PHI written on paper, electronic PHI, and physical or digital images that could identify the subject of health information. It is important to remember that PHI records are only covered by HIPAA when they are in the possession of a covered entity or business associate.

What is the difference between PHI and ePHI?

The different between PHI and ePHI is that ePHI refers to Protected Health Information that is created, used, shared, or stored electronically – for example on an Electronic Health Record, in the content of an email, or in a cloud database. Both PHI and ePHI are subject to the same protections under the HIPAA Privacy Rule, while the HIPAA Security Rule mostly relates to ePHI.

Does the Privacy Rule apply to both paper and electronic health information?

The Privacy Rule applies to both paper and electronic health information despite the language used in the original Health Insurance Portability and Accountability Act leading to a misconception that HIPAA only applies to electronic health records. While the protection of electronic health records was addressed in the HIPAA Security Rule, the Privacy Rule applies to all types of health information regardless of whether it is stored on paper or electronically, or communicated orally.

If an individual calls a dental surgery to make an appointment and leaves their name and telephone number, is that PHI?

If an individual calls a dental surgery to make an appointment and leaves their name and telephone number, the name and telephone number are not PHI at that time because there is no health information associated with them. Only once the individual undergoes treatment, and their name and telephone number are added to the treatment record, does that information become Protected Health Information.

How can future health information about medical conditions be considered “protected”?

Future health information about medical conditions can be considered protected if it includes prognoses, treatment plans, and rehabilitation plans that – if altered, deleted, or accessed without authorization – could have significant implications for a patient. For this reason, future health information must be protected in the same way as past or present health information.

Does the Privacy Rule apply when medical professionals are discussing a patient´s healthcare?

The Privacy Rule does apply when medical professionals are discussing a patient’s healthcare because, although PHI can be shared without authorization for the provision of treatment, when medical professionals discuss a patient´s healthcare, it must be done in private (i.e. not within earshot of the general public) and the Minimum Necessary Standard applies – the rule that limits the sharing of PHI to the minimum necessary to accomplish the intended purpose.

If a medical professional discusses a patient´s treatment with the patient´s employer, is that information protected?

If a medical professional discusses a patient’s treatment with the patient’s employer whether or not the information is protected depends on the circumstances. Usually, a patient will have to give their consent for a medical professional to discuss their treatment with an employer unless the discussion concerns payment for treatment or the employer is acting as an intermediary between the patient and a health plan.

However, disclosures of PHI to employers are permitted under the Privacy Rule if the information being discussed relates to a workplace injury or illness. In such circumstances, a medical professional is permitted to disclose the information required by the employer to fulfil state or OSHA reporting requirements. In these circumstances, medical professionals can discuss a patient’s treatment with the patient’s employer without an authorization.

Is an email PHI?

Whether or not an email is PHI depends on who the email is sent by, what the email contains, and where it is stored. To be PHI, an email has to be sent by a Covered Entity or Business Associate, contain individually identifiable health information, and be stored by a Covered Entity or Business Associate in a designated record set with an identifier (if the email does not already include one).

What is PHI is healthcare?

PHI in healthcare stands for Protected Health Information – information protected by the HIPAA Privacy Rule to ensure it remains private. PHI in healthcare can only be used or disclosed for permitted purposes without a patient´s authorization, and patients have the right to complain to HHS’ Office for Civil Rights if they believe a healthcare provider is failing to protect the privacy of their PHI.

What are HIPAA identifiers?

HIPAA identifiers are pieces of information that can be used – either separately or with other pieces of information – to identify an individual whose health information is protected by the HIPAA Privacy Rule. Several sources confuse HIPAA identifiers with PHI, but it is important to be aware identifiers not maintained with an individual´s health information do not have the same protection as PHI.

What qualifies as PHI?

What qualifies as PHI is individually identifiable health information and any identifying non-health information stored in the same designated record set. Please note that a Covered Entity can maintain multiple designated record sets about the same individual and that a designated record set can consist of a single item (i.e., a picture of a baby on a pediatrician’s baby wall qualifies as PHI).

Is a medical record number PHI?

A medical record number is PHI is it can identify the individual in receipt of medical treatment. However, a seemingly random alpha-numeric code by itself (which medical record numbers often are) does not necessarily identify an individual if the code is not proceeded with “medical record number”, or accompanied by a name or any other information that could be used to identify the individual.

What does PHI include?

PHI includes individually identifiable health information maintained by a Covered Entity or Business Associate that relates to an individual’s past, present, or future physical or mental health condition, treatment for the condition, or payment for the treatment. It can also include any non-health information that could be used to identify the subject of the PHI.

Is a person’s gender PHI?

A person’s gender is PHI if it is maintained in the same designated record set as individually identifiable health information by a HIPAA Covered Entity or Business Associate as it could be used with other information to identify the subject of the individually identifiable health information. However, if a person’s gender is maintained in a data set that does not include individually identifiable health information (i.e., a transportation directory), it is not PHI.

Is a patient’s name alone considered PHI?

A patient’s name alone is not considered PHI. Only when a patient’s name is included in a designated record set with individually identifiable health information by a Covered Entity or Business Associate is it considered PHI under HIPAA.

Under the Privacy Rule which information should be considered PHI?

Under the Privacy Rule, the information that should be considered PHI relates to any identifiers that can be used to identify the subject of individually identifiable health information. However, where several sources mistake what is considered PHI under HIPAA is by ignoring the definitions of PHI in the General Provisions at the start of the Administrative Simplification Regulations (45 CFR Part 160).

Is there a list of PHI identifiers?

There is no list of PHI identifiers in HIPAA – only an out-of-date list of identifiers that have to be removed from a designated record set under the safe harbor method before any PHI remaining in the designated record set is deidentified. Because the list is so out-of-date and excludes many ways in which individuals can now be identified, Covered Entities and Business Associates are advised to have a full understanding of what is considered PHI under HIPAA before developing staff policies.

Is a phone number PHI?

A phone number is PHI if it is maintained in a designated record set by a HIPAA Covered Entity or Business Associate because it could be used to identify the subject of any individually identifiable health information maintained in the same record set. However, if a phone number is maintained in a database that does not include individually identifiable health information, it is not PHI.

The post What is Considered PHI Under HIPAA? appeared first on HIPAA Journal.

Federal Court Dismisses FTC Complaint Against Kochava

Posted by HIPAA Journal

A complaint filed by the Federal Trade Commission (FTC) against the mobile app attribution and analytics company, Kochava, has been dismissed by a federal judge, although the door has been left open for a revised complaint that makes stronger arguments that the actions of Kochava have caused harms to consumers.

The FTC’s lawsuit against Kochava, filed in August 2022, alleged the company was selling the geolocation data of consumers gathered from their mobile phones without their knowledge. The geolocation data is tied to each individual user by a unique ID associated with their device. The FTC argued that the geolocation data could be used to identify individuals who had visited sensitive locations such as abortion clinics, mental health treatment centers, places of worship, and other sensitive locations. For example, the data sold by Kochava could be used to identify women who traveled from an anti-abortion state to a state where abortion is illegal, allowing those women to be prosecuted as well as the individuals that helped them have an out-of-state abortion. The FTC lawsuit alleged Kochava had engaged in unfair and deceptive business practices, in violation of the FTC Act. Kochava was aware that a lawsuit would likely be filed by the FTC and attempted to preempt it by filing its own lawsuit then sought to have the FTC lawsuit dismissed. Those efforts have been partially successful.

At this early stage of the litigation, the question that needed to be answered by the court was whether the FTC had stated a plausible claim against Kochava. Idaho District Judge B. Lynn Winmill said in his ruling that the privacy concerns raised by the FTC in the complaint were certainly legitimate and that the FTC’s theory that consumers could suffer an injury as a result of the sale of their data was certainly plausible. Judge Winmill agreed that individuals would be at risk of secondary harms but said the FTC failed to point to any specific examples of harms that have been caused, only stating a risk of secondary harms. The FTC failed to attach any degree of probability to the risks. While there is certainly a risk that geolocation data could be used to target individuals, the mere possibility of injury is not sufficient to allow the lawsuit to proceed.

The FTC argued that the invasion of privacy alone constitutes an injury, and while that is true, in this case, the privacy violation was not determined to be sufficiently severe to meet the threshold for injury. Specifically, because Kochava has not been accused of selling or disclosing private information, only selling data from which private information may be inferred from the presence of an individual in or near a sensitive location. The geolocation data does not indicate an individual has received a specific service or visited a location for a specific purpose and inferences are often unreliable. Further, location information could be obtained through legal means, such as observing a person visiting a sensitive location and then obtaining the individual’s address from public records. Finally, the FTC’s lawsuit would need to state, at least approximately, how many individuals could suffer privacy violations as a result of the sale of the data by Kochava. The FTC failed to state how many people are likely to be injured.

While the complaint was dismissed, Judge Winmill agreed that consumers have no reasonable way of avoiding potential harms that are caused as a result of Kochava’s business practices and that any benefits that come from the sale of the data do not outweigh the harms that can be caused. The FTC has been given a further 30 days to refile the lawsuit with strengthened arguments that the privacy violations will likely cause substantial injury to consumers.

The post Federal Court Dismisses FTC Complaint Against Kochava appeared first on HIPAA Journal.

DoE Issues New Guidance on FERPA and Student Health Records

Posted by HIPAA Journal

The U.S. Department of Education has issued new guidance for schools and postsecondary educational institutions reminding them of their obligations under the Family Educational Rights and Privacy Act (FERPA) to protect student privacy, emphasizing the importance of keeping student health records private. Guidance has also been issued for parents, legal guardians, and students over 18 years of age on their rights under FERPA (Know Your Rights) with respect to student health records.

FERPA was enacted to protect the privacy of student records and give parents rights over their children’s educational records. FERPA applies to educational agencies such as school districts, educational institutions (including public elementary and secondary schools), and postsecondary educational institutions (including colleges or universities) that receive funding under any program administered by the U.S. Department of Education.

The guidance for FERPA-covered educational institutions reminds them that parents and eligible students have the right to exercise some control over the disclosure of personally identifiable information in student educational records and confirms FERPA prohibits disclosures of educational records unless a parent or eligible student provides written consent or the disclosure is covered by an exception to FERPA’s general consent requirements.

The Department of Education has reminded FERPA-covered educational institutions that FERPA’s definition of educational records includes the health records of eligible students that are maintained by FERPA-covered educational institutions or their agents unless the health records qualify as treatment records. Health records qualify as treatment records if they relate to an eligible student (over 18 years of age at a postsecondary educational institution) and are “made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional or paraprofessional capacity or assisting in that capacity; made, maintained, or used only in connection with providing treatment to the eligible student; and disclosed only to the persons providing such treatment, except that the eligible student may have those records reviewed by a physician or other appropriate professional of the student’s choice.”

If an eligible student’s treatment records are disclosed for any purposes other than those described above – providing the eligible student with treatment or for personal review by a physician or appropriate professional of the eligible student’s choice – the records are classed as educational records and are therefore covered by FERPA, and are not classed as protected health information subject to the HIPAA Rules.

The guidance stresses that eligible students’ health-related records that are created, maintained, or used for non-treatment purposes are classed as educational records. For example, when they are used for medical forms and questionnaires to screen for eligibility to participate in school-sponsored athletics. Treatment records are also classed as educational records – and are therefore subject to FERPA’s restrictions on disclosures – if they are used for the treatment of students under 18 years of age who are attending an elementary or secondary school.

The guidance confirms that disclosures of student educational records (including certain health records) are only permitted by FERPA with the prior written consent of an eligible student or the student’s parent/legal guardian (non-eligible student) or if one of the permissive exceptions to the general consent requirement applies. When an exception applies, FERPA permits – but does not require – the disclosure. If the decision is taken to disclose student information the disclosure should be restricted to the minimum necessary amount of information to satisfy the intended purpose of the disclosure.

The guidance also clarifies when health records are covered by FERPA or HIPAA. FERPA applies to student health records that are maintained by campus health clinics and other health care facilities operated by such institutions, as they qualify as educational records or treatment records under FERPA, and as such are excluded from coverage under the HIPAA Privacy Rule. If an institution of postsecondary education is a HIPAA-covered entity that provides healthcare to nonstudents, the nonstudent data is protected health information subject to the HIPAA Privacy Rule and the student health records are educational or treatment records that are subject to FERPA.

The post DoE Issues New Guidance on FERPA and Student Health Records appeared first on HIPAA Journal.

March 2023 Healthcare Data Breach Report

Posted by HIPAA Journal

Our monthly data breach reports are based on data breaches of 500 or more records that have been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) each month. The monthly reports provide an indication of the extent to which healthcare data breaches are increasing, decreasing, or remaining flat. To view longer-term healthcare data breach trends, visit our healthcare data breach statistics page.

Healthcare Data Breaches Reported in March 2023

In March, 63 breaches of 500 or more records were reported to OCR, which is a 46.51% increase from February, 6.92% more than the 12-month average, and 40% more breaches than in March 2022.

March 2023 Healthcare Data Breach Report - 12 month breaches

There was a 15.62% month-over-month increase in breached records, with 6,382,618 records exposed or impermissibly disclosed across the 63 data breaches. That’s 36% more records breached than the 12-month average and 76.46% more breached records than in March 2022.

March 2023 Healthcare Data Breach Report - 12 month breached records

Largest Healthcare Data Breaches

In March, 22 healthcare data breaches were reported that impacted more than 10,000 individuals, up from 17 such breaches in February 2023. Four of those breaches, including the largest data breach of the month, were due to the use of tracking code on websites that collected individually identifiable website visitor data. The data collected was used for analytics purposes but was transferred to the providers of the code. Those third parties included, but were not limited to, Meta (Facebook), Instagram, & Google. These tracking tools are not prohibited by the HIPAA Privacy Rule, but if they are used, consent must be obtained, or the disclosure must be permitted by the Privacy Rule and a business associate must be in place with the provider of the code. We can expect to see many more of these breaches reported over the coming weeks and months. According to a recently published study, 99% of U.S. hospitals have used these tools on their websites. Relatively few have reported tracking code-related data breaches to OCR.

Malicious actors continue to use ransomware in their attacks on healthcare organizations. Three of the top 22 data breaches were confirmed as involving ransomware, and several other hacking incidents were reported that involved network disruption, but were not reported as involving ransomware. Several threat actors that are known to use ransomware in their attacks on the healthcare sector are now choosing not to encrypt files, instead, they just steal data for extortion. For example, the Clop ransomware group typically deploys ransomware in its attacks but in recent attacks that exploited a vulnerability in Fortra’s GoAnywhere managed file transfer (MFT) solution, ransomware was not deployed. The group stole data from 130 organizations in the attacks, including Community Health Systems Professional Services Corporations and US Wellness Inc, both of which are in the top 22 list.

There were three 10,000+ record data breaches involving the hacking of email accounts – through phishing or other means. Phishing attacks are common in healthcare, and while these attacks can be difficult to prevent, it is possible to limit the harm caused by placing time limits on how long emails are stored in email accounts. While emails often need to be retained for compliance with HIPAA and other laws –  moving them to a secure archive can help to reduce the extent of a data breach if email accounts are compromised. One of the phishing attacks saw one email account compromised that contained the PHI of more than 77,000 individuals.

Name of Covered Entity State Covered Entity Type Individuals Affected Cause of Breach
Cerebral, Inc DE Business Associate 3,179,835 Website tracking code – Impermissible disclosure to third parties
ZOLL Services LLC MA Healthcare Provider 997,097 Hacking incident (details not made public)
Community Health Systems Professional Services Corporations (CHSPSC), LLC TN Business Associate 962,884 Hacking of Fortra’s GoAnywhere MFT solution
Santa Clara Family Health Plan CA Health Plan 276,993 Hacking incident involving business associate – no information available
Monument, Inc. NY Business Associate 108,584 Website tracking code – Impermissible disclosure to third parties
Bone & Joint Clinic, S.C. WI Healthcare Provider 105,094 Hacking incident: Network disruption and data theft
Florida Medical Clinic, LLC FL Healthcare Provider 94,132 Ransomware attack
Healthy Options dba Postal Prescription Services – Kroger OH Healthcare Provider 82,466 Impermissible disclosure of PHI to Kroger
NorthStar Emergency Medical Services AL Healthcare Provider 82,450 Hacking incident (details not made public)
Merritt Healthcare Advisors CT Business Associate 77,258 Unauthorized accessing of employee email account
NewYork Presbyterian Hospital NY Healthcare Provider 54,396 Website tracking code – Impermissible disclosure to third parties
Trinity Health MI Business Associate 45,350 Phishing attack: employee email account compromised
UHS of Delaware, Inc. PA Business Associate 40,290 Unauthorized accessing of employee email account
SundaySky, Inc. NY Business Associate 37,095 Hacked cloud server – data theft confirmed
Denver Public Schools Medical Plans CO Health Plan 35,068 Hacked network server – data theft confirmed
Atlantic General Hospital MD Healthcare Provider 26,591 Ransomware attack
UC San Diego Health CA Healthcare Provider 23,000 Website tracking code used by a business associate – Impermissible disclosure to third parties
Tallahassee Memorial Healthcare, Inc. FL Healthcare Provider 20,376 Hacked network server – data theft confirmed
Northeast Surgical Group, PC MI Healthcare Provider 15,298 Hacked network server
Health Plan of San Mateo CA Health Plan 11,894 Unauthorized accessing of employee email account
US Wellness Inc. MD Business Associate 11,459 Hacking of Fortra’s GoAnywhere MFT solution
Codman Square Health Center MA Healthcare Provider 10,161 Ransomware attack

Causes of March 2023 Data Breaches

The majority of the month’s reported breaches were classified as hacking/IT incidents, as has been the case for many months. While hacking incidents usually account for the vast majority of breached records, in March they accounted for only 54.29% of the month’s breached records due to very large data breaches caused by the use of tracking technologies. The average size of a hacking incident in March was 73,724 records and the median breach size was 2,785 records.

March 2023 Healthcare Data Breach Report - causes

There were 14 data breaches reported as unauthorized access/disclosure incidents and while they only accounted for 22.22% of the month’s data breaches, they were responsible for 45.65% of the breached records, mostly due to the website tracking code breaches. The average breach size was 208,114 records and the median breach size was 2,636 records. There was one theft incident reported involving the protected health information of 3,013 individuals and one improper disposal incident involving 999 records.

March 2023 Healthcare Data Breach Report - data location

Where Did the Breaches Occur?

The entity reporting a data breach is not always the entity that experienced the breach. Business associates of HIPAA -covered entities may self-report breaches, but it is common for the covered entity to report the breaches. The data submitted to OCR indicates breaches occurred at 33 healthcare providers, 24 business associates, and 6 health plans. The pie charts below are based on where the breaches actually occurred rather than the reporting entity, as this provides a clearer picture of the extent to which data breaches are occurring at business associates.

March 2023 Healthcare Data Breach Report - breaches at hipaa-regulated entities

The pie chart below shows the extent to which patient and health plan member records have been exposed or compromised at business associates. 75.4% of the month’s breached records were due to data breaches at business associates.

March 2023 Healthcare Data Breach Report - records breached at hipaa-regulated entities

Geographical Distribution of March 2023 Data Breaches

Data breaches were reported by HIPAA-regulated entities in 25 U.S. states in March, with New York topping the list with 18 reported data breaches. The unusually high total was due to an attack on a business associate – Atlantic Dialysis Management Services – which reported the breach separately for each affected client and submitted 14 separate breach reports to OCR.

State Breaches
New York 18
California 7
Florida, Massachusetts, Ohio, Pennsylvania & Texas 3
Indiana, Kansas, Maryland, Michigan & Oregon 2
Alabama, Arizona, Colorado, Connecticut, Delaware, Georgia, Illinois, Kentucky, New Jersey, Oklahoma, Tennessee, Wisconsin & West Virginia 1

HIPAA Enforcement Activity in March 2023

No HIPAA enforcement actions were announced by the HHS’ Office for Civil Rights in March, but there was one enforcement action by a state Attorney General. The New York Attorney General confirmed that a case had been settled with the law firm, Heidell, Pittoni, Murphy & Bach LLP. The law firm was investigated following a breach of the personal and protected health information of 61,438 New York residents to identify potential violations of HIPAA and New York laws. The law firm chose to settle the case with no admission of wrongdoing and paid a financial penalty of $200,000. The New York Attorney General alleged violations of 17 HIPAA provisions and implementation specifications, details of which can be found here.

While the Federal Trade Commission does not enforce HIPAA, the agency has started taking action over breaches of healthcare data by non-HIPAA-covered entities to resolve violations of the FTC Act and the FTC Health Breach Notification Rule. In February, the FTC announced that its first settlement had been reached for a health data breach notification failure and that was followed up with a second enforcement action in March. The FTC announced that the online counseling service provider, BetterHelp, had agreed to settle alleged FTC Act violations related to impermissible disclosures of health data to third parties when users of its services had been told their information was private and confidential.  While there was no fine, under the terms of the settlement, $7.8 million will be paid to the consumers affected by the breach and they must be notified per the Health Breach Notification Rule.

The post March 2023 Healthcare Data Breach Report appeared first on HIPAA Journal.

OCR Proposes HIPAA Privacy Rule Update to Bolster Reproductive Health Care Privacy

Posted by HIPAA Journal

The HHS’ Office for Civil Rights has published a Notice of Proposed Rulemaking (NPRM) about an update to the HIPAA Privacy Rule to strengthen privacy protections for reproductive health information. The proposed update is in response to the Supreme Court decision in Dobbs v. Jackson Women’s Health Organization and the overturning of Roe v. Wade, which removed the federal right to abortion that has been in place for almost half a century.

Since that decision in 2022, states have been scrambling to enact abortion laws. 18 states have introduced full or partial bans on abortions in their states, and a further 4 states are due to introduce full or partial bans. There is concern that those states will attempt to prosecute state residents that seek abortions out of state and will request the health data of individuals from healthcare providers who provide reproductive health services or facilitate reproductive health care.

“When the Supreme Court overturned Roe v. Wade, nearly half a century of precedent changed overnight,” said Secretary Xavier Becerra in an announcement about the NPRM. “The Biden-Harris Administration is committed to protecting women’s lawful access to reproductive health care, including abortion care. President Biden signed not one but two executive orders calling on HHS to take action to meet this moment and we have wasted no time in doing so. Today’s action is yet another important step HHS is taking to protect patients accessing critical care.”

Currently, the HIPAA Privacy Rule permits but does not require HIPAA-covered entities to provide reproductive health information to law enforcement. OCR has released guidance on disclosures of reproductive health information and has clarified the circumstances when reproductive health information can be legally disclosed. OCR has also stated that noncompliance with the HIPAA Rules with respect to reproductive health care is an enforcement priority for OCR.

Today’s announcement is intended to enhance privacy protections and strengthen patient-provider confidentiality by prohibiting disclosures of reproductive health information to investigate or prosecute patients, providers, and others involved in the provision of legal reproductive health care, including abortion care.

Specifically, the proposed HIPAA Privacy Rule update will prohibit disclosures of reproductive health care information for:

  • Criminal, civil, or administrative investigations into or proceeding against any person in connection with seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.
  • The identification of any person for the purpose of initiating such investigations or proceedings.

These restrictions will apply in the following situations:

  • Reproductive health care is sought, obtained, provided, or facilitated in a state where the health care is lawful and outside of the state where the investigation or proceeding is authorized.
  • Reproductive health care that is protected, required, or expressly authorized by federal law, regardless of the state in which such health care is provided.
  • Reproductive health care that is provided in the state where the investigation or proceeding is authorized and is permitted by the law of the state in which such health care is provided.

Reproductive health care is defined as including, but not limited to, prenatal care, abortion, miscarriage management, infertility treatment, contraception use, and treatment for reproductive-related conditions such as ovarian cancer.

Under the proposed rule, if a request is received for protected health information that is potentially related to reproductive health care, a regulated entity will be required to obtain a signed attestation that the use or disclosure is not for a prohibited purpose. The attestations will be required for health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners.

“I have met with doctors across the country who have shared their stories,” said OCR Director Melanie Fontes Rainer. “These providers have expressed fear, anger, and sadness that they or their patients may end up in jail for providing or obtaining evidence-based and medically appropriate care. Trust is critical in the patient-doctor relationship and medical mistrust can damage and chill patients’ relationship with their providers, imperiling patient health, “added Fontes Rainer. “Today’s proposed rule is about safeguarding this trust in the patient-provider relationship, and ensuring that when you go to the doctor, your private medical records will not be disclosed and used against you for seeking lawful care.”

The post OCR Proposes HIPAA Privacy Rule Update to Bolster Reproductive Health Care Privacy appeared first on HIPAA Journal.

Washington Close to Enacting My Health My Data Act to Protect Health Data Privacy

Posted by HIPAA Journal

Washington state is on the brink of enacting a new law that will considerably expand privacy protections for consumer health data in the state and will address the current gap in privacy protections for health data not covered by the Health Insurance Portability and Accountability Act (HIPAA).

The My Health My Data Act (HB1155) was proposed by Representative Vandana Slatter (D-WA) and advanced through the House and was recently passed by the Senate with a vote of 27-21. The bill has now been returned to the House for a review of Senate amendments and, if the second vote is passed, the bill will is expected to be signed into law by state governor, Jay Inslee.

“My Health, My Data protects the independence and dignity of individuals when they make healthcare decisions,” said. Rep. Slatter. “It prevents vulnerabilities in the technological era that are being used to target and exploit consumers who may not be aware of [the] vast amount of data that everything from our watches and phones collect.” 

Data Covered by Washington My Health My Data Act

The My Health My Data Act applies to health data collected by non-HIPAA covered entities, including web and mobile publishers, and uses a broad definition of health data that includes diagnoses, conditions, treatment information, and biometric data, along with other data that is linkable to a state resident that can identify an individual’s past, present or future health or mental health.

The full definition of health data is any information that relates to “individual health conditions, treatment, status, diseases or diagnoses; social, psychological, behavioral and medical interventions; health-related surgeries or procedures; use or purchase of medications; bodily functions, vital signs and symptoms; diagnoses or diagnostic testing, treatment or medication; gender-affirming care information; reproductive or sexual health information; biometric data; genetic data; precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies; and information that is derived or extrapolated from non-health information.”

The bill covers location data, if that information can be used to make conjectures related to health. Location data is collected by many companies, even those that do not collect or process health data. Location data can reveal that an individual has visited a hospital, reproductive health clinic, pharmacy, or other healthcare location. Any company that collects location data for targeted advertising purposes will be required to comply with the requirements of the My Health My Data Act. The My Health My Data Act will apply to any entity that does business in the state of Washington that involves the collection of health data, regardless of revenue or size.

Consumer Consent and Control of Health Data

If passed, state residents will be given far greater control over how their health information is collected and used. Before any entity is able to collect health data, an individual must give their consent through an opt-in process, and the use of health data will be restricted to those specifically stated when obtaining consent. Those uses must also be strictly necessary to provide a product or service to the consumer.

When obtaining consent, it must be made clear to the consumer, in easy-to-understand, non-ambiguous language what they are consenting to, and consent must be obtained voluntarily. The same consent requirements apply to the sharing of health data and if the collecting entity intends to sell the data to a third party, written authorization will be required from the consumer. The reason for the sale must be stated when obtaining consent along with the entity or entities to which the data will be sold. The contact information of those entities must also be provided to the consumer. Consumers will also have the right to withdraw their consent, stop any processing of their data, and have that data deleted. Entities are also required to provide a clear privacy policy to consumers and implement a mechanism for processing consumer data requests, including requests for access to the collected data, withdrawal of consent, and data deletion.

Consumers Permitted to Take Legal Action for My Health My Data Act Violations

In order to get privacy legislation signed into law, protections are often put in place to protect businesses by preventing consumers from taking legal action over privacy violations. The My Health My Data Act does not have such restrictions and there is a private right of action that allows consumers to seek damages for My Health My Data Act violations. If a Washington resident is able to demonstrate that they have been harmed by a violation of the My Health My Data Act, they are permitted to take legal action to obtain damages under general consumer protection laws in the state.

The post Washington Close to Enacting My Health My Data Act to Protect Health Data Privacy appeared first on HIPAA Journal.

99% of Hospitals Use Website Tracking Code That Transmits Data to Third Parties

Posted by HIPAA Journal

New research indicates virtually all U.S. hospitals have been using tracking software on their websites that captures visitor data, including health information, and transfers that information to third parties. The study – published this month in Health Affairs – was conducted by researchers at the University of Pennsylvania. They used the 2019 American Hospital Association (AHA) Annual Survey to identify hospitals and narrowed their study to nonfederal acute care hospitals with an emergency department, which were not ambulatory surgery centers or freestanding long-term care facilities – The websites of 3,747 U.S. hospitals were assessed in the study.

The researchers used an open-source tool called WebXray to identify third-party tracking code and recorded data requests on the hospital websites over a 3-day period in 2021. The researchers also recorded cookies and data stored on browsers that would allow visitors to the websites to be tracked across the Internet.  They found 98.6% of the hospitals used at least one type of tracking code on their websites that transferred data to third parties and 94.3% used cookies that allowed visitors to the websites to be tracked across the Internet. Over the three-day study period, the home pages of the websites initiated a median of 16 data transfers.

The tracking code, sometimes referred to as pixels, is provided by third parties for use on websites for tracking visitors and the code is incredibly common across the Internet. The code is used to record website interactions, such as the pages visited, how visitors arrived on the website, and the sites they visited when they left. The data collected through the code can be used by website operators to improve their websites and services, but the data collected is also transferred to the third parties that provide the code.

While these technologies can be found on virtually all websites, the Health Insurance Portability and Accountability Act (HIPAA) does not permit the use of these technologies unless certain conditions are met as the tracking code can collect individually identifiable health information, including visits to web pages about specific medical conditions such as HIV, cancer, and Alzheimer’s disease, and information entered into web forms.

The third parties receiving the information are typically not HIPAA-regulated entities, which means uses and disclosures of the transferred data are largely unregulated. The transferred information could be used for a variety of purposes, such as serving targeted advertisements related to medical conditions, health insurance, or medications. What actually happens to the transferred data is unclear.

The HHS’ Office for Civil Rights (OCR) recently issued guidance for HIPAA-regulated entities on the use of tracking technologies on websites and apps and confirmed that the use of these technologies is not permitted by the HIPAA Privacy Rule unless the third parties receiving protected health information are legitimate business associates and a business associate agreement has been signed. Alternatively, authorizations are required before protected health information is transferred.

According to the study, hospitals in health systems, hospitals with a medical school affiliation, and hospitals serving urban patient populations had more third-party data transfers than other hospitals, which it was hypothesized could be due to the websites providing a more extensive range of services, the inclusion of third-party apps on the website – Google Maps for example – or them having a higher level of website advertising.

The third parties that most commonly received data were Alphabet (Google) – 98.5% of websites, Meta (Facebook) – 55.6% of websites, and Adobe Systems – 31.4% of websites. Other third parties commonly sent visitor data include AT&T, The Trade Desk, Oracle, Verizon, Rubicon Project, Amazon, Microsoft, Hotjar, StackPath, Siteimprove, Cloudflare, and Acxiom.

“By including third-party tracking code on their websites, hospitals are facilitating the profiling of their patients by third parties,” wrote the researchers. “These practices can lead to dignitary harms, which occur when third parties gain access to sensitive health information that a person would not wish to share. These practices may also lead to increased health-related advertising that targets patients, as well as to legal liability for hospitals.”

In 2021, three Boston hospitals – Massachusetts General Hospital, Brigham and Women’s Hospital, and Dana Farber Cancer Institute – agreed to pay more than $18 million to settle allegations they had shared website user data with third parties without consent, and many more lawsuits against healthcare providers are pending.

Given the recent guidance from OCR and the extent to which tracking code has been used, all hospitals should review their websites for tracking code and ensure that business associate agreements are in place, patient authorizations are obtained, or that the code is removed from the websites or is made HIPAA-compliant. If tracking code is found and protected health information has been impermissibly disclosed it is a reportable data breach and the HHS must be informed and notifications sent to affected patients.

The post 99% of Hospitals Use Website Tracking Code That Transmits Data to Third Parties appeared first on HIPAA Journal.

99% of Hospitals Use Website Tracking Code That Transmits Data to Third Parties

Posted by HIPAA Journal

New research indicates virtually all U.S. hospitals have been using tracking software on their websites that captures visitor data, including health information, and transfers that information to third parties. The study – published this month in Health Affairs – was conducted by researchers at the University of Pennsylvania. They used the 2019 American Hospital Association (AHA) Annual Survey to identify hospitals and narrowed their study to nonfederal acute care hospitals with an emergency department, which were not ambulatory surgery centers or freestanding long-term care facilities – The websites of 3,747 U.S. hospitals were assessed in the study.

The researchers used an open-source tool called WebXray to identify third-party tracking code and recorded data requests on the hospital websites over a 3-day period in 2021. The researchers also recorded cookies and data stored on browsers that would allow visitors to the websites to be tracked across the Internet.  They found 98.6% of the hospitals used at least one type of tracking code on their websites that transferred data to third parties and 94.3% used cookies that allowed visitors to the websites to be tracked across the Internet. Over the three-day study period, the home pages of the websites initiated a median of 16 data transfers.

The tracking code, sometimes referred to as pixels, is provided by third parties for use on websites for tracking visitors and the code is incredibly common across the Internet. The code is used to record website interactions, such as the pages visited, how visitors arrived on the website, and the sites they visited when they left. The data collected through the code can be used by website operators to improve their websites and services, but the data collected is also transferred to the third parties that provide the code.

While these technologies can be found on virtually all websites, the Health Insurance Portability and Accountability Act (HIPAA) does not permit the use of these technologies unless certain conditions are met as the tracking code can collect individually identifiable health information, including visits to web pages about specific medical conditions such as HIV, cancer, and Alzheimer’s disease, and information entered into web forms.

The third parties receiving the information are typically not HIPAA-regulated entities, which means uses and disclosures of the transferred data are largely unregulated. The transferred information could be used for a variety of purposes, such as serving targeted advertisements related to medical conditions, health insurance, or medications. What actually happens to the transferred data is unclear.

The HHS’ Office for Civil Rights (OCR) recently issued guidance for HIPAA-regulated entities on the use of tracking technologies on websites and apps and confirmed that the use of these technologies is not permitted by the HIPAA Privacy Rule unless the third parties receiving protected health information are legitimate business associates and a business associate agreement has been signed. Alternatively, authorizations are required before protected health information is transferred.

According to the study, hospitals in health systems, hospitals with a medical school affiliation, and hospitals serving urban patient populations had more third-party data transfers than other hospitals, which it was hypothesized could be due to the websites providing a more extensive range of services, the inclusion of third-party apps on the website – Google Maps for example – or them having a higher level of website advertising.

The third parties that most commonly received data were Alphabet (Google) – 98.5% of websites, Meta (Facebook) – 55.6% of websites, and Adobe Systems – 31.4% of websites. Other third parties commonly sent visitor data include AT&T, The Trade Desk, Oracle, Verizon, Rubicon Project, Amazon, Microsoft, Hotjar, StackPath, Siteimprove, Cloudflare, and Acxiom.

“By including third-party tracking code on their websites, hospitals are facilitating the profiling of their patients by third parties,” wrote the researchers. “These practices can lead to dignitary harms, which occur when third parties gain access to sensitive health information that a person would not wish to share. These practices may also lead to increased health-related advertising that targets patients, as well as to legal liability for hospitals.”

In 2021, three Boston hospitals – Massachusetts General Hospital, Brigham and Women’s Hospital, and Dana Farber Cancer Institute – agreed to pay more than $18 million to settle allegations they had shared website user data with third parties without consent, and many more lawsuits against healthcare providers are pending.

Given the recent guidance from OCR and the extent to which tracking code has been used, all hospitals should review their websites for tracking code and ensure that business associate agreements are in place, patient authorizations are obtained, or that the code is removed from the websites or is made HIPAA-compliant. If tracking code is found and protected health information has been impermissibly disclosed it is a reportable data breach and the HHS must be informed and notifications sent to affected patients.

The post 99% of Hospitals Use Website Tracking Code That Transmits Data to Third Parties appeared first on HIPAA Journal.