HIPAA Breach News

Ransomware Attack Impacts 16,000 National Ambulatory Hernia Institute Patients

On September 13, 2018, the National Ambulatory Hernia Institute in California experienced a ransomware attack that resulted in certain files on its network being encrypted.

According to the breach notice uploaded to the healthcare provider’s website, the attackers were potentially able to gain access to demographic data of patients recorded prior to July 19, 2018.

In total, 15,974 patients have had some of their protected health information exposed as a result of the attack. The information potentially accessed by the attackers was limited to names, addresses, birth dates, diagnoses, appointment dates and times, and Social Security numbers. Patients who visited National Ambulatory Hernia Institute facilities for the first time after July 19, 2018 were unaffected by the breach.

Due to the sensitive nature of the exposed information, the National Ambulatory Hernia Institute has advised affected patients to obtain identity monitoring services for a period of at least one year. The breach notice does not state whether those services are being provided to patients free of charge.

The National Ambulatory Hernia Institute explained that all data have now been transferred to an off-site server and additional controls have been purchased and implemented to prevent further attacks, including a more robust firewall and antivirus software solutions. The investigation into the breach is ongoing.

The National Ambulatory Hernia Institute did not state what type of ransomware was used in the attack, only that “the attack was tied to an email address glynnaddey@aol.com.”

That email address has previously been associated with a variant of CrySiS/Dharma ransomware called gamma. Gamma ransomware ransoms are not fixed and are not stated on the ransom demands. Victims must email the attackers to find out how much it will cost for the keys to unlock files. No mention was made about whether the ransom demand was paid to regain access to data.

The post Ransomware Attack Impacts 16,000 National Ambulatory Hernia Institute Patients appeared first on HIPAA Journal.

$16 Million Anthem HIPAA Breach Settlement Takes OCR HIPAA Penalties Past $100 Million Mark

OCR has announced that an Anthem HIPAA breach settlement has been reached to resolve potential HIPAA violations discovered during the investigation of its colossal 2015 data breach that saw the records of 78.8 million of its members stolen by cybercriminals.

Anthem has agreed to pay OCR $16 million and will undertake a robust corrective action plan to address the compliance issues discovered by OCR during the investigation.

The previous largest ever HIPAA breach settlement was $5.55 million, which was agreed with Advocate Health Care in 2016. “The largest health data breach in U.S. history fully merits the largest HIPAA settlement in history,” said OCR Director Roger Severino.

Anthem Inc., an independent licensee of the Blue Cross and Blue Shield Association, is America’s second largest health insurer. In January 2015, Anthem discovered cybercriminals had breached its defenses and had gained access to its systems and members’ sensitive data. With assistance from cybersecurity firm Mandiant, Anthem determined this was an advanced persistent threat attack – a continuous and targeted cyberattack conducted with the sole purpose of silently stealing sensitive data.

The attackers first gained access to its IT systems on December 2, 2014, with access continuing until January 27, 2015. During that time the attackers stole the data of 78.8 million plan members, including names, addresses, dates of birth, medical identification numbers, employment information, email addresses, and Social Security numbers.

The attackers gained a foothold in its network through spear phishing emails sent to one of its subsidiaries. They were then able to move laterally through its network to gain access to plan members’ data.

Anthem reported the data breach to OCR on March 13, 2015; however, by that time OCR was already a month into a compliance review of Anthem Inc. OCR took prompt action after Anthem uploaded a breach notice to its website and media reports started to appear indicating the colossal scale of the breach.

The OCR investigation uncovered multiple potential violations of HIPAA Rules. Anthem chose to settle the HIPAA violation case with no admission of liability.

OCR’s alleged HIPAA violations were:

  • 45 C.F.R. § 164.308(u)(1)(ii)(A) – A failure to conduct a comprehensive, organization-wide risk analysis to identify potential risks to the confidentiality, integrity, and availability of ePHI.
  • 45 C.F.R. § 164.308(a)(1)(ii)(D) – The failure to implement regularly review records of information system activity.
  • 45 C.F.R. § 164.308 (a)(6)(ii) – Failures relating to the requirement to identify and respond to detections of a security incident leading to a breach.
  • 45 C.F.R. § 164.312(a) – The failure to implement sufficient technical policies and procedures for electronic information systems that maintain ePHI and to only allow authorized persons/software programs to access that ePHI.
  • 45 C.F.R. § 164.502(a) – The failure to prevent the unauthorized accessing of the ePHI of 78.8 million individuals that was maintained in its data warehouse.

“Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people’s private information,” said Roger Severino. “We know that large health care entities are attractive targets for hackers, which is why they are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion or risk enforcement by OCR.”

In addition to the OCR HIPAA settlement, Anthem has also paid damages to victims of the breach. Anthem chose to settle a class action lawsuit filed on behalf of 19.1 million customers whose sensitive information was stolen. Anthem agreed to settle the lawsuit of $115 million.

2018 OCR HIPAA Settlements and Civil Monetary Penalties

Given the size of the Anthem HIPAA settlement it is no surprise that 2018 has seen OCR smash its previous record for financial penalties for HIPAA violations. The latest settlement takes OCR HIPAA penalties past the $100 million mark.

There have not been as many HIPAA penalties in 2018 than 2016(13), although this year has seen $1.4 million more raised in penalties than the previous record year and there are still 10 weeks left of 2018. The total is likely to rise further still.

OCR Financial Penalties for HIPAA Violations (2008-2018)

Year Settlements and CMPs Total Fines
2018 1 $24,947,000
2017 1 $19,393,000
2016 2 $23,505,300
2015 3 $6,193,400
2014 5 $7,940,220
2013 5 $3,740,780
2012 6 $4,850,000
2011 6 $6,165,500
2010 13 $1,035,000
2009 10 $2,250,000
2008 7 $100,000
Total 59 $100,120,200


HIPAA Fines and CMPs

Largest Ever Penalties for HIPAA Violations

Year Covered Entity Amount Settlement/CMP
2018 Anthem Inc $16,000,000 Settlement
2016 Advocate Health Care Network $5,550,000 Settlement
2017 Memorial Healthcare System $5,500,000 Settlement
2014 New York and Presbyterian Hospital and Columbia University $4,800,000 Settlement
2018 University of Texas MD Anderson Cancer Center $4,34,8000 Civil Monetary Penalty
2011 Cignet Health of Prince George’s County $4,300,000 Civil Monetary Penalty
2016 Feinstein Institute for Medical Research $3,900,000 Settlement
2018 Fresenius Medical Care North America $3,500,000 Settlement
2015 Triple S Management Corporation $3,500,000 Settlement
2017 Children’s Medical Center of Dallas $3,200,000 Civil Monetary Penalty

The post $16 Million Anthem HIPAA Breach Settlement Takes OCR HIPAA Penalties Past $100 Million Mark appeared first on HIPAA Journal.

Email Accounts Compromised at Biomarin Pharmaceutical and Envision Healthcare Corporation

Novato, CA-based Biomarin Pharmaceutical has discovered two employee email accounts have been compromised as a result of a phishing attack in which a temporary employee’s login credentials were obtained by the attacker.

The attack was discovered on June 21, 2018 and immediate action was taken to prevent further unauthorized account access. The investigation into the breach determined that the email accounts had been accessed by an unauthorized individual, but it was not possible to tell whether any emails were opened or copied by the attacker.

An analysis of the compromised accounts suggests a document containing names, health insurance information and Social Security numbers may have been in one or both email accounts at the time the breach.

Due to the nature of exposed data, affected individuals have been advised to place a fraud alert on their credit files as a precaution against identity theft and fraud and urged to monitor explanation of benefits statements from insurers for medical services which have not been received.

Biomarin Pharmaceutical has now secured its network and has taken steps to prevent further email account breaches.

Envision Healthcare Corporation Email Accounts Compromised

Portland, OR-based Envision Healthcare Corporation is notifying current and former providers, affiliates, and job applicants that some of their personal information may have been compromised. The information was contained in email accounts which have recently found to have been accessed by an unauthorized individual.

The email accounts were accessed by a third party in July 2018 and contained information such as names, birth dates, Social Security numbers, driver’s license numbers and financial information. To data, no evidence has been uncovered to suggest any information has been stolen and misused, although as a precaution against identity theft and fraud, affected individuals have been offered complimentary identity theft and credit monitoring services through Experian IdentityWorks’ Credit 3B service.

Envision Healthcare Corporation has already taken steps to secure its systems and is evaluating the implementation of multi-factor authentication.

The post Email Accounts Compromised at Biomarin Pharmaceutical and Envision Healthcare Corporation appeared first on HIPAA Journal.

Minnesota DHS Notifies 21,000 Patients That Their PHI Has Potentially Been Compromised

This week, the Minnesota Department of Human Services has mailed letters to approximately 21,000 individuals on medical assistance to alert them to a possible breach of their protected health information (PHI) due to two recent phishing campaigns.

Two DHS employees’ email accounts have been confirmed as having been compromised as a result of the employees clicking on links in phishing emails. The investigation into the breach determined that the attackers accessed both email accounts although it was not possible to determine which, if any, emails in the account had been accessed or copied by the attackers.

Minnesota DHS has reason to believe that other employees may also have been targeted and could also have clicked on links in phishing emails, but it has not yet been confirmed whether their accounts have been breached. The investigation into the phishing attacks is ongoing.

The two email account breaches occurred on June 28 and July 9, 2018, although the IT department only determined that the accounts had been breached in August. Upon discovery of the phishing attack, both accounts were secured to prevent further access.

It has taken a considerable amount of time to conduct the investigation and determine which patients have been affected. That process required every single email in each account to be checked for patient information, hence the delay in issuing breach notification letters.

Most of the individuals affected by the breach had previously interacted with the State Medical Review Team, although some individuals who had received services from Minnesota DHS Direct Care and Treatment facilities also had some of their PHI exposed.

The PHI in the compromised email accounts included full names, addresses, telephone numbers, birth dates, Social Security numbers, educational records, medical information, employment information, and financial information.

“We immediately took steps to secure these accounts, and currently have no evidence that any information was actually viewed, downloaded or misused,” explained Minnesota DHS in a statement about the breach. “We take data privacy very seriously at DHS, and continue to work with our employees and partners to prevent cyberattacks.”

The post Minnesota DHS Notifies 21,000 Patients That Their PHI Has Potentially Been Compromised appeared first on HIPAA Journal.

Michigan Medicine Notifies 3,600 Patients of PHI Disclosure Due to Mailing Error

Michigan Medicine is notifying more than 3,600 patients of an impermissible disclosure of a limited amount of their protected health information.

In early September 2018, the Michigan Medicine Development Office launched a fundraising campaign that involved sending letters to a large number of its patients. A third-party vendor was contracted to print the letters for the mailing and while many of the letters were printed correctly, an error was made by the printing company that resulted in an impermissible disclosure of certain patients’ personal information.

According to Michigan Medicine, the error was introduced when the printing company installed new software. As a result of the error, a proportion of the letters contained information that was intended for other Michigan Medicine patients and did not match the name and address on the outside of the envelope.

Since this was a fundraising mailing, the letters did not contain any medical information, Social Security numbers, financial data, or other highly sensitive information. Patients affected by the error has their name, address, and in some cases email address and contact telephone number, disclosed to another Michigan Medicine patient.

The error was detected by Michigan Medicine on September 4, 2018 and prompt action was taken to alert the vendor to the error to prevent any further impermissible disclosures of patient information.

“Patient privacy is extremely important to us, and we take this matter very seriously,” said Jeanne Strickland, Michigan Medicine chief compliance officer. “Michigan Medicine took steps immediately to investigate this matter.”

As an additional measure to prevent similar breaches, Michigan Medicine’s Development Office will be using window envelopes for future mailings, eliminating the need to match envelopes with letters.

The Mailing error was a reportable breach under HIPAA and the Department of Health and Human Services’ Office for Civil Rights (OCR) was notified well inside the 60-day reporting deadline. The breach summary on the OCR website indicates 3,624 patients were affected by the incident.

The post Michigan Medicine Notifies 3,600 Patients of PHI Disclosure Due to Mailing Error appeared first on HIPAA Journal.

California HIV Patient PHI Breach Lawsuit Allowed to Move Forward

A lawsuit filed by Lambda Legal on behalf of a victim of a data breach that saw the highly sensitive protected health information of 93 lower-income HIV positive individuals stolen by unauthorized individuals has survived a motion to dismiss.

The former administrator of the California AIDS Drug Assistance Program (ADAP), A.J. Boggs & Company, submitted a motion to dismiss but it was recently rejected by the Superior Court of California in San Francisco.

In the lawsuit, Lambda Legal alleges A.J. Boggs & Company violated the California AIDS Public Health Records Confidentiality Act, the California Confidentiality of Medical Information Act, and other state medical privacy laws by failing to ensure an online system was secure prior to implementing that system and allowing patients to enter sensitive information.

A.J. Boggs & Company made its new online enrollment system live on July 1, 2016, even though it had previously received several warnings from nonprofits and the LA County Department of Health that the system had not been tested for vulnerabilities.

It was alleged that the failure to ensure its system was secure meant that any information entered in the portal by patients was at risk of exposure and could potentially be obtained by unauthorized individuals. In November 2016, four months after the system went live, A.J. Boggs & Company took the system offline to correct the flaws.

However, in February 2017, the California Department of Health discovered that the flaws in its portal had been exploited and unauthorized individuals had gained access to the system and had downloaded the private and highly sensitive information of 93 patients with HIV or AIDS. Following the discovery, the contract with the firm was cancelled and a new state-run system was adopted.

The ADAP program provides states with federal funding to provide financial assistance to low-income individuals with HIV or AIDS to make HIV medications more affordable, extending access to Medicaid when patients earned too much. Any medical data breach is serious, although the disclosure of an individual’s HIV status is especially so.

“HIV is still a highly stigmatized medical condition,” said Scott Schoettes, HIV Project Director at Lambda Legal. “When members of already vulnerable communities — transgender people, women, people of color, undocumented people, individuals with low incomes — already face challenges in accessing health care, undermining the trust they have in the ADAP is not just a breach of security; it creates a barrier to care.”

Lambda Legal is seeking statutory and compensatory damages for the patient and is seeking class action status to allow the other 92 breach victims to be included in the lawsuit.

The post California HIV Patient PHI Breach Lawsuit Allowed to Move Forward appeared first on HIPAA Journal.

PHI of 37,000 Gold Coast Health Plan Members Potentially Compromised

Camarillo, CA-based Gold Coast Health Plan is informing approximately 37,000 plan members that some of their protected health information has potentially been obtained by hackers who succeeded in compromising the email account of one of its employees.

The employee was fooled by a phishing email and responded disclosing login credentials to the email account. The attackers gained access to the email account on June 18, 2018 and access remained possible until August 1, 2018. Gold Coast Health Plan discovered the security breach on August 8 and took steps to secure the account and prevent any further remote access.

A leading third-party cybersecurity firm was engaged to conduct an investigation into the breach and assess the scope of the incident and determine whether any patients’ health information was accessed. It was not possible to rule out PHI access and data theft with 100% certainty, although no reports have been received to date that suggest any PHI in the account has been misused.

Gold Coast Health Plan believes the attack was financially motivated and the purpose of the attackers was to gain access to banking information in order to make fraudulent transfers from Gold Coast Health Plan accounts rather than to steal plan members’ data.

The investigation confirmed that the compromised account contained claims data, health plan ID numbers, and the dates medical services had been received by plan members. Some individuals also had their name, birthdate, and/or medical procedure codes exposed. The types of information exposed varied for each patient with many patients only having one or two of the above data elements exposed.

Even though Social Security numbers and financial information was not exposed, Gold Coast Health Plan is offering breach victims a MyIDCare subscription and identity theft protection services through ID Experts without charge.

The breach has prompted Gold Coast Health Plan to implement further security controls to prevent similar breaches from occurring in the future. Those measures include enhanced end user training on security with a specific focus on phishing, increased monitoring of email accounts, and enhancements to email security controls.

The post PHI of 37,000 Gold Coast Health Plan Members Potentially Compromised appeared first on HIPAA Journal.

Summary of Recent Healthcare Data Breaches

A round up of healthcare data breaches recently announced by healthcare providers and business associates of HIPAA covered entities.

Tillamook Chiropractic Clinic Discovers 26-Month Malware Infection

The medical records of 4,058 patients of the Tillamook Chiropractic Clinic in Tillamook, OR have been stolen as a result of a malware infection.

On August 3, 2018, the clinic conducted an internal security audit which showed that malware had been installed on its network, even though a firewall was in place, antivirus and antimalware software were installed and up to date, and its software was fully patched. An investigation into the security breach revealed the malware had been installed on May 24, 2016 and had remained undetected for 26 months. The malware had been installed on the primary insurance billing system, which the clinic reports was used as a staging area by the attackers to collect patient records before exfiltrating the data.

The information believed to have been stolen includes full names, home addresses, work addresses, dates of birth, phone numbers, diagnoses, lab test results, medications, driver’s license numbers, insurance billing information, bank routing numbers, bank account numbers, employee payroll data, and for Medicare patients, Social Security numbers.

Tillamook Chiropractic Clinic removed the malware on August 3, 2018 and has now modernized and upgraded its computer security systems and policies.

Gwinnett Medical Center Investigating Possible Hack

A possible data breach has occurred at Lawrenceville, GA-based Gwinnett Medical Center. The PHI of approximately 40 patients has been accessed by an unauthorized individual according to Gwinnett Medical Center spokeswoman Beth Hardy. Names, genders, and dates of birth were exposed on Twitter and notification letters are being sent to those 40 individuals to alert them to the breach.

However, the breach could be far larger. Steve Ragan at Salted Hash reported that a source at the medical center said threats had been received from the attackers and that the breach potentially impacts hundreds of patients. The attackers allegedly posted data on Twitter as they claimed the medical center was attempting to cover up the breach.

Gwinnett Medical Center has informed the FBI about the security breach and is still conducting investigations into the cyberattack.

Hardy said, “GMC takes cyber security very seriously and we are committed to maintaining the integrity, availability and confidentiality of our systems and data.”

Toyota Industries North America Breach Impacts 19,000 Individuals

Columbus, IN-based Toyota Industries North America (TINA) has announced that approximately 19,000 current and former employees and health plan participants of the TINA family of companies have been informed that some of their PHI has been exposed. An unauthorized individual succeeded in gaining access to a small number of company email accounts and potentially viewed/copied PHI.

The breach was discovered on August 30 and information security experts were called in to help secure its system and investigate the breach. A wide range of PII and PHI were present in the compromised email accounts including first and last names, home addresses, dates of birth, phone numbers, financial account information, social security numbers, photographs of social security cards, driver’s license numbers, photographs of driver’s licenses, email addresses, photographs of birth certificates, photographs of passports, treatment information, prescription information, diagnoses, health plan beneficiary numbers and portal usernames, passwords and security questions.

All affected individuals have been notified by mail and have been offered a year of free credit monitoring and identity theft protection services. TINA has taken several steps following the breach to improve security, including implementing multi-factor authentication, making real-time security monitoring enhancements, and revising its password protection and password resetting policies. TINA is also currently reviewing and updating user training and technology and security practices to reduce the risk of further email breaches.

722 Patients Affected by Kansas City Business Associate Mis-mailing Incident

The Kansas City, MO-based revenue cycle management company, Pulse Systems, has announced that the PHI of 722 patients of Lincoln Pulmonary and Critical Care in Nebraska has been impermissibly disclosed. An error was made sending statements on July 27 that resulted in individuals receiving statements intended for other patients. The statements included only included names and procedure information. Steps have now been taken to prevent similar errors from being made in the future and all affected individuals have been notified about the privacy breach.

Oklahoma Department of Human Services Mis-mailing Incident Affects 813 Individuals

More than 800 parents and guardians who were involved in a developmental disabilities services program run by the Oklahoma Department of Human Services (ODHS) have been notified that some of their PHI has been impermissibly disclosed as a result of a computer software error. The error resulted in envelopes being mis-addressed in Plan of Care change notice mailings sent between May 17 and July 25.

The mailings contained names, addresses, DHS case numbers, Medicaid client ID numbers, plan of care numbers, providers’ names, services authorized and beginning and end dates, and an explanation that the person is authorized to receive Medicaid Home and Community-Based Waiver Services. No Social Security numbers were disclosed.

ODHS believes 813 individuals have received mailings containing someone else’s information, although it is not possible to tell if any other individuals have been affected.

Email Account Breaches Result in Exposure of 16,000 Individuals’ PHI

Ransom Memorial Hospital in Ottawa, KS, has discovered an unauthorized individual has gained access to an as of yet undisclosed number of email accounts which have been determined to contain the PHI of 14,239 individuals. A further email account breach was detected by Lakewood, CO-based Personal Assistance Services of Colorado, which has resulted in the exposure of 1,839 individuals’ PHI.

The post Summary of Recent Healthcare Data Breaches appeared first on HIPAA Journal.

PHI of 1,800 Patients Found Abandoned in Houston Street

Paperwork containing the protected health information of approximately 1,800 patients has been discovered abandoned in a Midtown, Houston street by an employee of the CBS-affiliated television station KBOU 11.

The paperwork contained information such as patients’ names, birth dates, diagnoses, treatment information, medications, vital signs, and admission dates. KBOU launched an investigation into the breach and determined the paperwork related to patients from five Houston hospitals – MD Anderson Cancer Center, LBJ Hospital, Children’s Memorial Hermann, Memorial Hermann Hospital, and TIRR Memorial Hermann. The investigation led to UT Health.

According to the report, the records were stolen from the locked trunk of a vehicle belonging of a medical resident who, while studying at UTHealth’s McGovern Medical School, had worked at the above hospitals. The records were stolen from his vehicle in July.

Officials at UT Health confirmed to KBOU that they are aware of the breach. Reporters spoke to the medical graduate and confirmed that the incident had not been reported to the police until after he had been contacted by KBOU reporters.

A spokesperson for UTHealth issued a statement saying, “We promptly took steps to investigate the circumstances of the disclosure, which revealed that the stolen documents had been discarded on a city street and found a day later by an employee of KHOU-TV Channel 11.” The records were collected by that employee and were returned to UTHealth and have now been secured. UTHealth found no evidence to suggest that any information in the documents was viewed by unauthorized individuals.

It is unclear why the records were removed from the hospitals in the first place, why the theft was not reported to law enforcement immediately, and why the hospitals concerned had not been informed about the breach until after the records were discovered by KBOU. According to UTHealth, the affected hospitals will be issuing notifications to all affected patients in due course.

The post PHI of 1,800 Patients Found Abandoned in Houston Street appeared first on HIPAA Journal.