Oklahoma Heart Hospital has started notifying certain patients about a privacy incident in which paperwork containing limited patient information was accidentally donated to charity.

A former employee had made handwritten notes which contained the protected health information of a limited number of patients during the course of that individual’s employment at Oklahoma Heart Hospital between 2011 and 2014.

Some of the former employee’s personal possessions were donated to charity in May 2021, with the handwritten notes accidentally included in the donated items. Oklahoma Heart Hospital was contacted by the individual who found the notes and arrangements were immediately made to collect the paperwork. The documents were then cataloged to identify the patients involved and the types of information that had been exposed.

The notes included information such as patients’ names, medical record numbers, OHH visit numbers, dates of birth, ages, admit dates, genders, and clinical information consisting of diagnosis, lab results, medications and/or treatment information. No information was exposed that would have provided unauthorized individuals with access to patient record systems.

While the protected health information of some patients was viewed by an individual not authorized to view the information, Oklahoma Heart Hospital has not uncovered any evidence to suggest any patient data has been further disclosed or misused; however, out of an abundance of caution, all affected individuals have been notified by mail and advised to monitor their account and explanation of benefits statements for signs of fraudulent activity.

The privacy breach has been reported to the Department of Health and Human Services’ Office for Civil Rights as affecting 1,038 patients.

The post Paperwork Containing PHI of Oklahoma Heart Hospital Patients Accidentally Donated to Charity appeared first on HIPAA Journal.

The Nebraska Department of Health and Human Services has announced a security incident involving the protected health information of clients of Aging Partners, a department of the City of Lincoln.

The breach was discovered by the Lincoln Information Services Department on May 25, 2021. Employees had responded to phishing emails and disclosed credentials to their email accounts, which contained more than 46,000 emails. Assisted by a computer forensics company, it was determined that the email account was accessed by an unauthorized individual between May 18 and May 21.

A review of the emails in the account confirmed some contained patient information such as names, addresses, dates of birth, phone numbers, Social Security numbers, dates of service, type/amount of service, and some health information such as diagnoses, care assessments, and medication lists. Emails also contained bank account numbers or other financial information of a limited number of individuals. 6,600 of the emails included the PHI of Aging Partners’ clients, although only 1,513 individuals have been affected. For the majority of affected individuals, only names were included in the email accounts.

All affected individuals are now being notified and credit monitoring and identity theft protection services are being offered to individuals whose financial information was present in the compromised email accounts.

UNC Health Reports Phishing Attack

UNC Health has announced that an email account containing the protected health information of patients of University of North Carolina at Chapel Hill School of Medicine (SOM) and the University of North Carolina Hospitals (UNC Hospitals) has been accessed by an unauthorized individual.

On May 20, 2021, UNC Health discovered the email account of a SOM faculty member had been compromised. That individual provided clinical services at UNC Hospitals. The email account was immediately secured, and an investigation was launched to determine the extent of the breach. Assisted by a third-party cybersecurity firm, UNC Health determined that the email account breach was isolated to April 20, 2021 and no other email accounts or systems were involved.

A review of the account revealed the following types of information could potentially have been compromised: Patients’ names, dates of birth, diagnosis and treatment information, and/or information about a research study patients may have been involved in or have been eligible for at UNC Hospitals/SOM. The email account contained the health insurance information of fewer than 30 patients and the Social Security numbers of fewer than 10 patients. There have been no reported cases of misuse of patient data.

Additional email security measures are being implemented and employees are being provided with further training to help them identify phishing emails.

The post UNC Health and Nebraska DHHS Report Phishing Attacks appeared first on HIPAA Journal.

The medical payment billing service provider MultiPlan has announced a breach of its email environment. On January 27, 2021, suspicious activity was identified in the email account of one of its employees. Action was immediately taken to terminate unauthorized access and the employee’s email credentials were changed.

MultiPlan immediately launched an investigation to determine the nature and scope of the breach, with assistance provided by forensics experts. The investigation confirmed that the main purpose of the attack was to divert wire transfers from MultiPlan customers looking to pay invoices. The email account was compromised and used by the attacker to communicate with those customers regarding billing, and to attempt to divert payments to an account under their control.

While protected health information does not appear to have been targeted in the attack, the compromised email account was found to contain the protected health information of 214,956 individuals. That information could have been viewed or obtained by the attacker between December 23, 2020 and January 27, 2021.

The types of information in the account included full names, addresses, email addresses, dates of birth, healthcare provider names, medical record numbers, date/cost of healthcare services, claims identifiers, health insurance ID numbers, member IDs, group IDs, and Social Security numbers.

MultiPlan has notified all affected individuals and will be covering the cost of two years of credit monitoring. Additional protocols and processes have now been implemented to prevent further email breaches in the future.

Hawaii Independent Physicians Association Reports Email Account Breach

Hawaii Independent Physicians Association (HIPA) is notifying 18,770 patients about a security incident involving the email account of a subcontractor.

On February 4, 2021, HIPA determined an unauthorized individual had accessed the email account. External access to the account was immediately blocked and all HIPA users were required to change their login credentials for their system and email accounts and as a precaution. Assisted by a third-party cybersecurity firm, HIPA determined the breach was limited to a single email account which contained the protected health information of patients of its physicians.

The types of information in the compromised account included full names, dates of birth, home addresses, and information about the general health condition of patients. No evidence of unauthorized data access was found, but the possibility that PHI was viewed or obtained could not be ruled out.

The cybersecurity firm investigating the breach made recommendations to improve email security and HIPA is in the process of implementing the suggested changes.

The post Email Account Breaches Reported by MultiPlan and Hawaii Independent Physicians Association appeared first on HIPAA Journal.

Three more healthcare providers have announced they have been affected by the recent ransomware attack on the Swedish radiation therapy and radiosurgery solution provider Elekta Inc.

Elekta provides a cloud-based mobile application called SmartClinic, which is used by healthcare providers to access patient information for cancer treatments. Cybercriminals gained access to Elekta’s systems between April 2, 2021 and April 20, 2021 exfiltrated the SmartClinic database prior to deploying ransomware and encrypting files. The database contained the personal and protected health information (PHI) of patients of 42 healthcare systems in the United States. Elekta notified affected customers in May 2021.

Advocate Aurora Health has recently announced that 68,000 of its patients across 7 sites in Illinois have been affected by the attack. The following types of PHI were acquired by the ransomware gang: names, addresses, dates of birth, height and weight measurements, Social Security numbers, driver’s license numbers, diagnosis information, treatment information, and appointment confirmations.

Advocate Aurora Health said no evidence has been found to suggest information obtained in the attack has been misused, but complimentary credit monitoring, fraud consultation, and identity theft restoration services have been offered to affected individuals as a precaution. Advocate Aurora Health said it has been working with Elekta to ensure steps are taken to prevent similar events in the future.

Philadelphia, PA-based Jefferson Health said the database contained the PHI of cancer patients who received treatment at its Sidney Kimmel Cancer Center. Patient names, dates of birth, medical record numbers, physician names, department, date(s) of service, treatment plans, diagnosis and/or prescription information were compromised. For some patients, a Social Security number was also included in the database. Patients are being notified by mail and have been offered complimentary credit monitoring and identity theft protection services. Jefferson Health said it is now re-evaluating its relationship with Elekta. Jefferson Health has not yet disclosed how many patients were affected.

Intermountain Healthcare in Salt Lake City, UT said patient names and scanned image files were potentially compromised. The image files included data such as medical intake forms and medical images, which may have included dates of birth, demographic information, insurance cards, other identification cards, and Social Security numbers. Intermountain Healthcare has been working with Elekta to implement additional safeguards, including migrating its data to a new-generation Elekta cloud system. The 28,628 affected patients have been offered complimentary credit monitoring services.

The post Advocate Aurora Health, Jefferson Health, and Intermountain Healthcare Affected by Elekta Ransomware Attack appeared first on HIPAA Journal.

Sierra Nevada Primary Care Physicians in California is alerting 1,717 patients about an incident involving the theft of some of their protected health information, including names and credit card information.

On May 20, 2021, Sierra Nevada Primary Care Physicians was notified by the District Attorney’s office that two envelopes containing receipts from the practice had been found in the vehicle of a suspect.

The receipts were for payments made by patients between January 1, 2019 and March 20, 2019. For individuals who paid in person at the front desk using a debit or credit card, the receipts contained the individual’s name, name of the practice, amount charged, and the last four digits of the card number. Receipts for payments made by individuals using a debit card or credit card by mail or over the phone included that individual’s name, debit/credit card number, expiry date, CVV code, signature, practice name, and amount charged.

The District Attorney confirmed that the two envelopes and receipts were recovered and the perpetrators were arrested. Sierra Nevada Primary Care Physicians has offered affected individuals 12 months of complimentary credit monitoring services but believes misuse of information is unlikely. Steps have since been taken to improve security, including keeping receipts in a locked room that only two individuals can access, and all receipts now have the credit card information blacked out.

University of Maryland, Baltimore Impacted by Accellion Cyberattack

University of Maryland, Baltimore has announced the protected health information of 30,468 individuals was compromised in a cyberattack on its Accellion File Transfer Appliance (FTA) in December 2020.

Hackers gained access to the system, exfiltrated data, and issued a ransom demand for the safe return of the stolen data. Some of that information was subsequently published on the hacker’s data leak site.

University of Maryland said the system was used by students and faculty staff and was rigorously monitored and patches to fix security issues were promptly applied; however, in this instance, a vulnerability was exploited for which a patch had not yet been released by Accellion.

A plan had already been formed to replace the system with a newer, more secure system prior to learning about the breach. The plan was executed in February 2021 and the legacy Accellion FTA appliance has now been replaced. Complimentary credit monitoring services have been offered to affected individuals.

The post Sierra Nevada Primary Care Physicians Alerts Patients About Theft of PHI appeared first on HIPAA Journal.

The Lake County Health Department in Illinois has announced it has suffered two data breaches that potentially involved the personal and protected health information of around 25,000 patients.

The first breach occurred in 2019 when a Lake County Health employee sent an unencrypted email from their work email account to an internal employee’s personal email account. The email had an attached spreadsheet of medical record requests dating from December 2016 to June 2019. The requests had been made through a third-party company which handled release of information requests for the Lake County Health Department. The spreadsheet included the names of 24,241 patients along with dates relevant to the vendor.

Lake County Health discovered the breach on July 22, 2019; however, it took until July 2021 for notification letters to be sent to affected patients. The reason for the delay of almost two years was due to Lake County Health officials not believing notification letters were required, as no personal health information had been compromised; however, the Department of Health and Human Services disagreed with that assessment and required notification letters to be issued as personal health information may have been compromised.

A second data breach was discovered on May 14, 2021 which involved a Google spreadsheet containing names, dates of birth, email addresses, phone numbers, and the COVID-19 vaccination status of 705 individuals. The spreadsheet was saved in the personal Google Drive account of an employee. While Google Drive can be a HIPAA compliant solution for use in healthcare along with other G Suite services, personal accounts are not. Google can access information in personal Google accounts and uses that information to deliver tailored services and advertisements. All affected individuals were seniors who had sought information on COVID-19 vaccinations. Those individuals have now been notified.

While both privacy incidents resulted in patient data being exposed, Lake County Health said internal risk assessments were conducted and no evidence was found to indicate any of the exposed information had been acquired by unauthorized individuals or misused.

The Lake County Health Department has since implemented solutions to prevent any similar breaches in the future, including encryption of all email and enhanced monitoring.

The post Lake County Health Department Notifies 25,000 Patients About Two Data Breaches appeared first on HIPAA Journal.