Associates in Dermatology, a network of dermatology clinics in Indiana, Kentucky, and New York, has started notifying patients that some of their protected health information has been exposed in a ransomware attack on one of its business associates.

Virtual Private Network (VPN) Solutions provides electronic medical record management services to healthcare providers and Associates in Dermatology used its TouchChart software to host patient data. The ransomware attack was detected by VPN Solutions on or around October 31, 2021, and Associates in Dermatology was notified on December 22, 2021, that none of its data was accessed or stolen in the attack, but was told the forensic investigation into the attack was ongoing.

Associates in Dermatology said VPN Solutions was contacted on multiple occasions to ask how the forensic investigation was progressing and to obtain a formal report about the attack, but it took until January 17, 2023, to discover patient data had been exposed – 15 months after the breach was detected, and 2 months after VPN Solutions determined that files had been exposed.

According to the breach notice, electronic medical records were not exposed, but tag image files from a data warehouse may have been obtained in the attack. Most of those files did not contain patient data, but VPN Solutions said some of the files could be linked to patient names. Associates in Dermatology said VPN Solutions did not confirm if individually identifiable information or protected health information was contained in the files and did not provide a list of patient names.

Associates in Dermatology said its own analysis determined on March 10, 2023, that the compromised files may have contained personally identifiable information. The types of information varied from patient to patient and may have included one or more of the following data elements: first and last name, address, Social Security number, date of birth, medical condition(s)/diagnosis, treatment information, test results, health insurance policy number, subscriber identification number, health plan beneficiary number, and unique AID patient identifiers.

Associates in Dermatology said VPN Solutions has taken steps to improve security and has rebuilt its entire environment and restored all data. Associates in Dermatology performed a review of its contracts with third-party vendors and assessed their cybersecurity measures and has offered affected individuals complimentary credit monitoring and identity theft protection services.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal so it is currently unclear how many individuals have been affected.

47,000 Special Needs Student Records Exposed Online

A non-password-protected database containing the records of more than 47,000 special needs students has been exposed to the Internet and could be accessed by anyone without any authentication. The database was found by security researcher Jeremiah Fowler in mid-February, who traced the database to a company called Encore Support Services. Encore Support Services is a Brooklyn, NY-based provider of special education, behavioral health, and related services. Fowler notified Encore Support Services about the data exposure and the database has now been secured.

According to Fowler, the 6.74 GB database stored records going back to 2018 and included invoices containing student names, addresses, parent names, Open Student Information System (OSIS) numbers, service provider names, vendor information, EIN/SSN tax identification, and billing hours. The invoices also included codes for services that indicated a disability.

The data could be used for a range of nefarious purposes. For instance, Encore Support Services could be impersonated and parents contacted and asked to reveal sensitive information or pay a small charge on their credit card. Since a threat actor would have access to students’ unique OSIS numbers, case numbers, and therapy histories, the requests would be convincing.

Fowler was unable to determine how long the database had been exposed and whether it had been accessed by unauthorized individuals but suggests that the database most likely has not been exposed for long as it had not been encrypted using ransomware or deleted for extortion purposes.

The post Associates in Dermatology Patients Affected by Business Associate Ransomware Attack appeared first on HIPAA Journal.

SundaySky, a New York-based provider of software solutions to businesses for creating marketing videos, has recently announced that unauthorized individuals gained access to servers in its cloud environment and may have obtained customer data. Unauthorized access was detected on January 8, 2023, and the forensic investigation confirmed that files were exfiltrated between January 6 and January 8, 2023. Those files contained customer-provided health plan information from December 2018 to January 2019.

SundaySky worked with the health plan provider to determine the compromised information, and the review was completed on February 20, 2023. Notifications have now been sent to the 37,095 affected individuals. The types of data compromised included first names, personal email addresses, Healthcare Savings Account (HSA) effective date and deductible, and information related to copay. SundaySky said additional technical safeguards have now been implemented for its cloud environment to prevent similar breaches in the future.

Postal Prescription Service Impermissibly Disclosed Patient Names to Kroger

Healthy Options Inc., which does business as Postal Prescription Service (PPS), has announced an impermissible disclosure of limited patient information to its affiliated grocery business. On January 10, 2023, PPS discovered that the names and email addresses of 82,466 patients had been shared with the Kroger Co. and were used to create grocery accounts for those individuals. The affected individuals had created an online PPS account between July 2014 and January 13, 2023.

PPS said the impermissible disclosure was due to an internal error and its website has since been updated to address the problem. Affected individuals have been notified by mail.

Texas Medical Liability Trust Alerts Policyholders About PHI Breach

Texas Medical Liability Trust has recently notified 625 medical insurance policyholders that some of their personally identifiable information has been exposed. Suspicious network activity was detected on or around October 12, 2022, and the investigation confirmed that unauthorized individuals had access to parts of its network between October 2, 2022, and October 13, 2022.

The review of the affected files was completed on December 12, 2022, and affected individuals were notified on January 13, 2023, by Texas Medical Liability Trust on behalf of itself and its affiliates, Texas Medical Insurance Company, Physicians Insurance Company, and Lone Star Alliance, Inc., a Risk Retention Group.

The exposed information included names, Social Security numbers, driver’s license numbers, and financial account information. Texas Medical Liability Trust said additional safeguards have been implemented and employees have received further training. Affected individuals have been offered complimentary credit monitoring services for 12 months.

The post SundaySky Cyberattack Impacts 37,000 Health Plan Members appeared first on HIPAA Journal.

The Birmingham, AL, Heart Hospital, Cardiovascular Associates, has recently announced that unauthorized individuals gained access to certain parts of its network between November 28, 2022, and December 5, 2022, and removed files containing patient information. The breach was detected on December 5, 2022, and immediate action was taken to contain the breach and prevent further unauthorized access. A leading digital forensics firm was engaged to investigate the breach and confirmed data theft had occurred.

The review of the affected files revealed they contained the following types of information: Full names, birth dates, addresses, Social Security numbers, health insurance information, medical record numbers, dates of service, provider/facility names, visit/procedure/diagnosis information, medical tests results and images, billing and claims information, passport numbers, driver’s license numbers, credit/ debit card information, and financial account information. The types of data compromised varied from patient to patient and the usernames and passwords of a limited number of patients were also compromised.

Cardiovascular Associates has strengthened system security to prevent similar breaches in the future and its security and monitoring capabilities have been enhanced. Individuals whose Social Security number, credit card/debit card information, financial account information, passport or driver’s license number was compromised have been offered free credit monitoring and identity restoration services.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal but has been reported to the Maine Attorney General as affecting 441,640 individuals.

Great Neck/Mid Island Dental Reports Third-Party Data Breach

Richard T. Miller, DMD, PC, doing business as Great Neck/Mid Island Dental, has recently announced via his legal counsel that the protected health information of 22,933 individuals may have been accessed by unauthorized individuals. The data breach occurred at a law firm that helped Great Neck Dental acquire the assets of another dental practice in 2015. Cooperman Lester Miller Carus LLP (CLMC), assisted the seller with the acquisition and was provided with information as part of the business transaction, which included patient information. Great Neck Dental was notified on October 7, 2022, that an unauthorized individual had gained access to the email account of a CLMC partner between March 27, 2022, and June 1, 2022. The email account contained patient names, dates of birth, Social Security numbers, and dental insurance information.

Richard T. Miller said Great Neck/Mid Island Dental systems were unaffected and no reports of data misuse have been detected; however, as a precaution, affected individuals have been offered complimentary identity protection services.

Multnomah County Health Department Says Records of 2,000 Clients Potentially Accessed in Break-in

The Multnomah County Health Department in Oregon has confirmed that the personal information of approximately 2,000 individuals has potentially been accessed in a break-in at the Multnomah County Health Department headquarters. The break-in occurred over the weekend of February 17/18, 2023, and was discovered on February 21 due to the President’s Day holiday.

A county laptop computer and a new client cell phone were stolen and the perpetrator also entered an area where paper records were stored that contained client information. The suspected perpetrator was arrested last week by law enforcement. All affected clients and employees have been notified by mail if they were affected.

The post Alabama Healthcare Provider Announces 441,000-Record Data Breach appeared first on HIPAA Journal.

University of California (UC) San Diego Health is the latest healthcare organization to start notifying patients that some of their protected health information has been impermissibly disclosed to third parties due to the use of website tracking technologies. UC San Diego Health said the analytics code was added to its scheduling websites by one of its business associates, Solv Health, without authorization from UC San Diego Health. UC San Diego Health contracted with Solv Health to provide website hosting and management services.

The analytics code captured limited data of visitors to the scheduling websites who booked in-person or telehealth appointments. The captured information was then impermissibly disclosed to the third parties that provided the code. UC San Diego Health did not state in its breach notifications who the third parties were but said they received first and last names, birth dates, email addresses, IP addresses, third-party cookies, reasons for the appointments, and insurance type (e.g., PPO, HMO, Other).

UC San Diego Health confirmed that Social Security numbers, medical record numbers, financial account numbers, and debit and credit card information were not disclosed and the analytics code was not used on its electronic health record or MyUCSDChart systems, so no information within those systems was disclosed. UC San Diego Health said notification letters started to be mailed to affected individuals on March 20, 2023. Those individuals had used the scheduling websites for its Express Care (La Jolla) or Urgent Care locations (Downtown San Diego, Encinitas, Eastlake/Chula Vista, Pacific Highlands Ranch, & Rancho Bernardo).

When the analytics code was discovered in December 2022, UC San Diego Health directed Solv Health to immediately remove the code from the scheduling websites and worked with Solv Health to determine who had been affected. UC San Diego Health is now using a new online scheduling tool and has enhanced its vendor assessment and management procedures.

The incident has been reported to the HHS’ Office for Civil Rights and local media outlets; however, it is currently unclear how many individuals have been affected. This post will be updated when that information is made public.

The post UC San Diego Health Announces Impermissible Disclosure of Patient Data Due to Website Analytics Code appeared first on HIPAA Journal.

South Bend, IN-based Beacon Health System (BHS) says the medical records of 3,117 patients have been accessed by an employee when there was no legitimate work reason for viewing the records. The unauthorized activity was detected on or around January 10, 2023, prompting an investigation to determine the extent of the privacy violation.

BHS said the employee’s work duties were related to patient registrations, verification of benefits, and patient placements within the hospital. As such, security privileges allowed access to clinical documentation in medical records, as access to clinical information was occasionally necessary. The investigation confirmed on February 20, 2023, that the medical record access was unrelated to the employee’s work duties, with the period of access spanning from November 18, 2018, to February 24, 2023.

The information accessed included names, addresses, birth dates, Social Security numbers, and clinical information such as diagnoses, emergency care treatment information, labs and diagnostic testing, operative and anesthesia documentation, ancillary clinical documentation, and medical histories. BHS said notification letters are being sent to affected individuals and confirmed that the employee no longer works at BHS.

California Secretary of State Confirmed Impermissible Disclosure of Historical Health Records

The California Secretary of State has recently confirmed there has been an impermissible disclosure of historic records. A researcher has requested records from the state’s sterilization program, which are public when they are older than 75 years; however, the records provided to the researcher included data from 1948 to 1952. The records were provided on December 19 and December 22, with the former provided on-site and the latter by secure digital transfer.

The researcher notified the California Secretary of State about the error on December 23, 2022. The disclosure was due to a mislabeled data range. The researcher confirmed the records had not been viewed in detail and have since been deleted from the researcher’s computer. The records included personally identifiable information such as names, family member names, dates of birth, familial medical histories, and medical information such as diagnoses, operation dates, sterilization dates, and other medical information. The California Secretary of State arranged a review of the records and redacted the records from the microfilm.

Sensitive PHI Exposed at Baltimore Occupational Health Service Provider

Boxes of files containing sensitive patient information have been discovered outside Occupational Medical Services in Baltimore, MD. Occupational Medical Services provides drug and alcohol testing and care in worker compensation cases. The boxes had been opened by some members of the public and were found to contain names, contact information, health information, and Social Security numbers.

According to FOX45 reporters, who contacted company owner Joyce Phillips, the files came from a medical facility that had closed down and were due to be collected and shredded. 200 boxes of files had been moved outside where they had remained for a day awaiting collection.

The post Employee of Beacon Health System Impermissibly Accessed 3,100 Patients Records appeared first on HIPAA Journal.

Livonia, MI-based Trinity Health has confirmed that an unauthorized individual gained access to an employee email account and potentially viewed or obtained patient information. Suspicious account activity was detected in the employee’s email account on January 5, 2023. The investigation confirmed unauthorized access to the email account occurred between December 16, 2022, and December 18, 2022.

A review of the contents of the account was completed on February 14, 2023. The types of information in the account varied from patient to patient and may have included names, medical record numbers, patient ID numbers, encounter numbers, location(s) of service, provider names and specialties, procedure name(s), insurance name/type, billing balances, and dates of birth. A limited number of individuals had their address, phone number, email address, and prescription information exposed.

Trinity Health changed the account password to prevent further unauthorized access and has reviewed its policies and procedures. Due to the nature of the exposed information, Trinity Health believes the potential for misuse is low; however, affected individuals have been offered a complimentary 12-month membership to a credit monitoring and identity theft protection service.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many patients have been affected.

Beaver Medical Group Patients Affected by Email-Related Breach

Beaver Medical Group and Epic Management in California, part of the Optum Group, have started notifying certain patients that an employee’s workstation has been compromised as a result of a response to a phishing email. The email account was accessed for a limited period of time, but during that window of opportunity, emails may have been viewed or copied. The forensic investigation concluded on February 3, 2023, that the exposed information included names, member ID numbers, health plan information, and premium payment amounts.

Beaver and Epic have confirmed that security controls have been enhanced on their servers to prevent similar breaches in the future and monitoring has been enhanced. The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many patients have been affected.

AllCare Plus Pharmacy Reports Summer 2022 Phishing Attack

AllCare Plus Pharmacy in Northborough, MA, has recently reported a phishing attack to the Maine Attorney General that has affected 5,971 patients. On June 21, 2022, AllCare Plus Pharmacy identified a phishing campaign targeting multiple employees. Prompt action was taken to remove the phishing emails from its email systems and prevent unauthorized account access; however, several employee accounts were accessed by unauthorized individuals.

While no evidence of misuse of patient data has been identified, it should be assumed that protected health information was accessed or obtained. The review of the affected accounts confirmed they contained names, addresses, birth dates, Social Security numbers, driver’s license and other ID numbers, financial information, and limited health and health insurance information related to treatment and prescriptions.

AllCare Plus Pharmacy said additional security measures, internal controls, and safeguards have been implemented, and affected individuals have been offered 24 months of credit monitoring services.

The post Three Healthcare Providers Report Phishing Attacks appeared first on HIPAA Journal.

Florida Medical Clinic, NorthStar Emergency Medical Services, Denver Public Schools, Wichita Urology Group, and The Bone & Joint Clinic have recently reported hacking incidents and the exposure and potential theft of protected health information.

Florida Medical Clinic

Florida Medical Clinic has recently announced that it was the victim of a ransomware attack. The attack was detected on January 9, 2023, and prompt action was taken to contain the attack, which limited data exposure, although files were encrypted. The third-party forensic investigation confirmed the attacker accessed files that contained patients’ protected health information; however, its electronic medical record system was not affected.

In a refreshingly detailed breach notice, Florida Medical Clinic explained that 94,132 files had been exposed, each of which only contained limited patient information. 95% of the compromised files only included an individual’s name. The remaining files included names, phone numbers, email addresses, birth dates, and addresses. No financial information was compromised, and only 115 Social Security numbers were exposed.

Florida Medical Clinic said evidence was obtained of all stolen files being permanently deleted, which indicates the ransom was paid. No evidence of misuse of patient data has been uncovered. All affected patients have been notified and additional cybersecurity measures have been implemented to prevent further attacks, including replacing certain system components and changing remote access protocols.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many patients have been affected.

NorthStar Emergency Medical Services

Tuscaloosa, AL-based NorthStar Emergency Medical Services has recently reported a data breach that has affected up to 82,450 patients. According to the notice sent to the Maine Attorney General, suspicious activity was detected within its computer network on September 16, 2022; however, it took until March 8, 2023, to determine that patient data had been exposed. The breach notice did not state when the attackers first gained access to its network.

The affected files contained information such as names, Social Security numbers, birth dates, patient ID numbers, treatment information, Medicare/Medicaid numbers, and health insurance information. Notification letters were sent to affected individuals on March 14, 2023. Complimentary credit monitoring and identity theft protection services have been offered to affected individuals and steps have been taken to harden security.

Denver Public Schools

Denver Public Schools has recently announced that unauthorized individuals gained access to some of its servers and exfiltrated files that contained sensitive employee data. Data theft was discovered on January 4, 2023, and the forensic investigation confirmed unauthorized individuals had access to its network between December 13, 2022, and January 13, 2023.

The document review revealed the affected files included names, Social Security numbers, fingerprints (if on file), bank account numbers/pay card numbers, student ID numbers, driver’s license numbers, passport numbers, and some health plan enrollment information. The breach was reported to the HHS’ Office for Civil Rights as involving the protected health information of 35,068 current and former participants in its employer-sponsored health plan. It is unclear how many students were affected by the data breach. Denver Public Schools said additional security measures have been implemented to prevent similar breaches in the future. Credit monitoring and identity theft protection services are being offered to affected individuals.

The Bone & Joint Clinic in Wisconsin

The Bone & Joint Clinic, which operates 7 clinics in Wisconsin, has recently notified current and former employees and patients about a cyberattack that was detected on January 16, 2023, which caused network disruption. According to the notification letters, unauthorized individuals potentially accessed and acquired files containing information such as names, addresses, phone numbers, birth dates, Social Security numbers, health insurance information, and diagnosis and treatment information.

Affected individuals were notified on March 7, 2023, and offered 12 months of complimentary credit monitoring and identity theft protection services. The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many patients have been affected.

Wichita Urology Group

Wichita Urology Group in Kansas has recently notified 1,493 individuals that unauthorized individuals gained access to its network and potentially viewed or obtained files containing names, prescription information, billing information, and health insurance information.

Suspicious activity was detected within its network on January 3, 2023, with the forensic investigation confirming the intrusion occurred on January 2. The forensic investigation confirmed on January 26, 2023, that protected health information had been exposed; however, there has been no detected misuse of patient data. Technical security measures have been enhanced to prevent further attacks.

The post Protected Health Information Exposed in 5 Recent Hacking Incidents appeared first on HIPAA Journal.