The Peoria, IL-based not-for-profit catholic health system OSF HealthCare has started notifying 53,907 patients about a cyberattack that was discovered on April 23, 2021.

OSF HealthCare said upon discovery of the breach, steps were taken to prevent further unauthorized access and a third-party forensic investigator was engaged to conduct an investigation into the attack to determine the extent of the breach. The investigator confirmed the attackers first accessed its systems on March 7, 2021 and access remained possible until April 23, 2021.

OSF HealthCare said the attackers accessed certain files on its system that related to patients of OSF HealthCare Little Company of Mary Medical Center and OSF HealthCare Saint Paul Medical Center. On August 24 it was determined the following types of patient data may have been compromised:

Names, contact information, dates of birth, Social Security numbers, driver’s license numbers, state/government ID numbers, treatment information, diagnosis information and codes, physician names, dates of service, hospital units, prescription information, medical record numbers, and Medicare/Medicaid or other health insurance information. A subset of patients also had financial account information, credit/debit card information or credentials for an online financial account exposed.

Individuals whose Social Security number or driver’s license number was compromised in the attack have been offered complimentary credit monitoring and identity protection services through Experian. OSF HealthCare says it has implemented additional safeguards and technical security measures to prevent further attacks.

The substitute breach notice on the OSF HealthCare website makes no mention of the nature of the attack, but this appears to have been a ransomware attack involving data theft, with data potentially stolen 7 months ago.

Databreaches.net says it was alerted to the publication of stolen data on a dark web leak site in June and notified OSF HealthCare about the exposure of patient data. A ransomware operation known as Xing Team claimed responsibility for the attack and uploaded data to its dark web leak site that included patients’ protected health information. Databreaches.net said “according to a counter on the site, the listing has been accessed more than 350,000 times.”

The post Almost 54,000 Patients Affected by OSF HealthCare Ransomware Attack appeared first on HIPAA Journal.

Schneck Medical Center in Seymour, IN has announced it was a victim of a cyberattack which has had an impact on organizational operations.

The attack was detected on September 29, 2021 and an announcement was made the same day. In response to the attack, all IT systems within its facilities were suspended out of an abundance of caution, and third-party cybersecurity experts have been engaged to assist with the investigation and restore its IT system as quickly as possible. Schneck Medical Center said investigations into cyberattacks and the restoration of IT systems take time to fully resolve, but steps have been taken to minimize disruption to its systems.

Schneck Medical Center said most medical services have not been affected by the attack and patients should arrive as normal for scheduled services and appointments. Patients will be notified individually if for any reason their appointment has had to be postponed as a result of the attack.

“As a team of dedicated and caring medical professionals, we understand that healthcare is about people taking care of people. We remain committed to continuing to provide exceptional care to our communities and will provide additional updates as appropriate,” said Schneck Medical Center in its breach notification.

At this stage it is unclear if patient information has been compromised. Further information will be released about the attack if the investigation confirms the attackers gained access to systems containing patient information.

PHI Potentially Compromised in Epilepsy Foundation of Texas Phishing Attack

The email account of an employee of Epilepsy Foundation of Texas has been accessed by an unauthorized individual who potentially viewed or obtained sensitive patient data. Epilepsy Foundation of Texas discovered the email account had been compromised on or around June 8, 2021 when the account was used to send fraudulent emails. The email account was immediately secured and an investigation was conducted to determine the nature and scope of the breach.

The investigation confirmed the account was breached when the employee responded to a phishing email. An analysis of the incident and review of the information in the email account was completed on September 2, 2021 and efforts were then made to obtain accurate address information for affected individuals to allow notifications to be sent. Notification letters started to be sent to affected individuals on October 1, 2021.

Epilepsy Foundation of Texas said the compromised email account contained first and last names, dates of birth, driver’s license numbers, health insurance information, financial account numbers, Social Security numbers, biometric data, payment card numbers, usernames and passwords, and medical information.

Following the attack, security protocols were reviewed and have now been enhanced. Epilepsy Foundation of Texas said it is unaware of any cases of attempted or actual misuse of patient data but has advised affected patients to exercise caution and monitor their accounts and explanation of benefits statements for signs of fraudulent activity.

The post Cyberattacks Reported by Schneck Medical Center and Epilepsy Foundation of Texas appeared first on HIPAA Journal.

The Clearwater, FL-based non-profit behavioral health service provider Directions for Living was the victim of a ransomware attack on July 17, 2021.

Upon detection of the attack, law enforcement was notified and third-party computer forensics experts were engaged to investigate the scope of the attack and assist with remediation efforts. The investigation concluded on August 30, 2021.

A review of servers potentially accessed by the attackers confirmed they contained personal and protected health information of current and former clients, including names, addresses, dates of birth, Social Security numbers, diagnostic codes, claims information, insurance information, healthcare provider names, date of service, and certain health information. Directions for Living said its electronic medical record system was not affected and could not be accessed by the attackers and clients’ financial information was not stored on the affected servers. While personal and protected health information may have been accessed by unauthorized individuals, Directions for Living said no evidence has been found to indicate any actual or attempted misuse of that information.

“For nearly 40 years, Directions for Living has been a proud and trusted resource for those seeking a welcoming and compassionate provider of behavioral health services. We take this role, and our commitment to our community, very seriously,” said Directions for Living. “Please know that your privacy is always our top priority, and we are working diligently to respond appropriately and continue to ensure that you are protected, and your information is safe with us.”

The process of notifying affected individuals started on August 30, in accordance with the requirements of the HIPAA Breach Notification Rule. Affected individuals have been advised to be vigilant and to check their account statements, credit reports, and explanation of benefits statements for signs of fraudulent activity. Individuals whose Social Security numbers have been exposed have been offered complimentary credit monitoring and identity theft monitoring services for 12 months.

The breach report submitted the Department of Health and Human Services’ Office for Civil Rights indicates the protected health information of 19,494 individuals was stored on the affected servers.

The post Ransomware Attack on Florida Behavioral Health Service Provider Affects 19,000 Individuals appeared first on HIPAA Journal.

Lisle, IL-based Navistar Inc. has issued further notification letters to individuals affected by a security breach that was detected on May 20, 2021.

The U.S. truck manufacturer immediately implemented its cybersecurity response plan when a potential breach of its information technology systems was detected, and third-party cybersecurity experts were engaged to assist with the investigation and determine the nature and scope of the breach.

On May 31, 2021, Navistar was informed that certain data had been extracted from its systems in the attack. The investigation into the data theft confirmed on August 20, 2021 that the exfiltrated files contained the protected health information of current and former members of Navistar Health Plan and the Navistar Retiree Health Benefit and Life Insurance Plan. That information is understood to have been stolen prior to the discovery of the security breach on May 20.

Navistar said the exfiltrated data potentially included names, addresses, dates of birth, and information related to participation on the health and insurance plans, which may have included some health-related information such as the names of providers and prescriptions. A subset of individuals also had their Social Security numbers compromised.

Navistar said it has taken several actions following the security incident, including enhancing its security protocols and controls, implementing new technology, and conducting further training for the workforce. Security controls will continue to be assessed and updated as appropriate to prevent further security breaches.

Notification letters were sent to affected individuals to alert them to the data breach in early July, with the latest notification letters providing further information on the same incident, including advising additional individuals that further investigation into the security breach shoed their Social Security numbers had also been compromised.

Navistar said it is offering a 2-year complementary membership to credit monitoring and identity theft protection services to individuals who had their Social Security number compromised in the attack.

The breach was reported to the Maine Attorney General as affecting 63,126 individuals, with the breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicating the protected health information of 49,000 plan members was compromised.

The post PHI of Navistar Health Plan Members Compromised in May 2021 Cyberattack appeared first on HIPAA Journal.

Horizon House, Inc., a Philadelphia, PA-based provider of mental health and residential treatment services has announced its IT systems have been hacked and the protected health information of 27,823 individuals has potentially been compromised.

Suspicious activity was detected in its computer systems on March 5, 2021. An investigation was launched to determine the nature and scope of the breach, which revealed an unauthorized individual had access to its systems between March 2 and March 5, 2021.

A review of files stored on the compromised systems was completed around September 3, 2021. The files contained protected health information such names, addresses, Social Security numbers, driver’s license numbers, state identification card numbers, dates of birth, financial account information, medical claim information, medical record numbers, patient account numbers, medical diagnoses, medical treatment information, medical information, health insurance information, and medical claims information.

All individuals affected by the incident have been notified and advised to monitor their accounts and explanation of benefit statements for signs of fraudulent activity. Existing policies and procedures and security measures are being reviewed and will be enhanced to prevent further data breaches.

Samaritan Center of Puget Sound Reports Break-in and Theft of Devices Containing PHI

A computer, server, and other electronic equipment have been stolen from the offices of Samaritan Center of Puget Sound in Seattle, WA. The break in occurred over the weekend of July 17/18, 2021 and was discovered on the morning of July 19.

Samaritan Center said the offices were locked and the computer and server were password protected; however, passwords can be brute forced so it is possible that the thieves may be able to access protected health information stored on the devices.

The server contained agency data including client names, dates of service, diagnoses, copies of charting content, addresses, phone numbers, copies of deposited checks, training videos, insurance information, Social Security numbers, and copies of billing statements. Samaritan Center said therapists’ email accounts, QuickBooks data, the Valant EHR platform, and archived data from its Medisoft client database are not believed to be at risk.

Samaritan Center said there have been multiple break-ins at the Ravenna Blvd facility over the past 12 months, and steps have been taken throughout the year to improve security including additional security alarm coverage, video cameras, and new locks. Further physical and electronic safeguards are being implemented, including attaching the server to the facility in a way that makes physical access to the server in the event of a break-in unlikely.  Samaritan Center is also exploring further encryption of network data.

The breach has been reported to the HHS’ Office for Civil Rights as affecting of 20,866 individuals.

The post Data Breaches Reported by Horizon House and Samaritan Center of Puget Sound appeared first on HIPAA Journal.

McAllen Surgical Specialty Center in Texas has started notifying patients about a ransomware attack that was detected on May 14, 2021.

Third-party computer forensics specialists were engaged to investigate the breach and determine the nature and scope of the attack. The investigators determined unauthorized individuals had gained access to certain computers and servers on May 12, 2021 and deployed ransomware. Unauthorized access to its network was blocked on May 14.

A comprehensive analysis was conducted to determine the servers and computers that had been affected, and which had potentially been accessed by the hackers. On July 22, it was determined patient data had potentially been compromised in the attack.

The affected computers and servers contained a range of patient information, with the types of exposed data varying from patient to patient. Data potentially affected included names, addresses, Social Security numbers, dates of service, health insurance information, provider name, patient numbers, and medical record numbers.

No evidence of data theft was identified and McAllen Surgical said in its September 20, 2021 substitute breach notice that it is unaware of any instances of actual or attempted misuse of patient data; however, affected employees and patients have been advised to be vigilant and monitor their accounts and explanation of benefit statements for signs of fraudulent activity. Notifications started to be mailed to affected patients on September 20, 2021.

McAllen Surgical said it will be reviewing and enhancing its existing policies and procedures to prevent further privacy breaches. The ransomware attack has been reported to the Department of Health and Human Services’ Office for Civil Rights as affecting 29,227 individuals.

The post PHI of 29,000 Patients Potentially Compromised in McAllen Surgical Specialty Center Ransomware Attack appeared first on HIPAA Journal.

Vista Radiology Reports Breach of the PHI of up to 3,634 Individuals

Knoxville, TN-based Vista Radiology has notified 3,634 patients about a ransomware attack experienced on July 11, 2021 which took part of its network offline. A leading computer forensics firm was engaged to conduct a full investigation into the attack. And the initial investigation appeared to suggest the sole purpose of the attack was to encrypt its systems, and that data exfiltration was not involved. However, Vista Radiology was informed on July 15 that some evidence had been found that files or folders containing patient data had been accessed and viewed.

The investigation confirmed files were encrypted in the evening of July 10 with a subset of those files accessed prior to encryption. The files that had been viewed only contained a limited amount of patient data and no significant amount of data were exfiltrated by the attackers. It was not possible to determine if the PHI of any specific patients had been accessed, so notification letters were sent to all patients potentially affected by the attack. The investigation indicates protected health information was not acquired or misused.

Vista Radiology said the encrypted data had been backed up and could be restored and that it did not negotiate with the malicious third party. Steps have since been taken to improve the security of its network environment, which involved a complete rebuild and redesign of network security. All affected patients have been notified and offered 12-months of complimentary identity and credit monitoring services.

Indian Creek Foundation Breach Affects 2,405 Patients

Indian Creek Foundation has notified 2,405 patients about a ransomware attack that occurred on February 6, 2021. Steps were immediately taken to contain the attack and third-party computer forensics specialists were engaged to investigate the security breach.

The investigation confirmed certain files and folders may have been exfiltrated from its systems prior to the use of ransomware to encrypt files. On or around April 15, 2021, a programmatic and manual review of all affected files was conducted to determine which patients were affected and what data was involved. It was confirmed on or around July 14 that patient was included in compromised files and folders. It took until August 24 to verify contact information for those individuals and notification letters have now been sent to all affected patients.

The data potentially viewed or exfiltrated by the attackers included names, Social Security number, driver’s license number, health insurance information, medical treatment/diagnosis information, and financial account information. Complimentary access to credit monitoring and identity restoration services have been offered to those individuals.

Indian Creek Foundation said policies and procedures have been revied and updated and additional safeguards have been implemented to reduce the likelihood of a similar events in the future.

Mankato Clinic Privacy Breach Affects 535 Patients

Mankato, MN-based Mankato Clinic has discovered a breach of the protected health information of 535 patients. On August 3, 2021, a spreadsheet containing patient data was emailed to an external email account in error by an employee. The error was detected within a few minutes and the recipient was contacted and told to delete the email and spreadsheet.

The recipient confirmed that the email had been deleted and the spreadsheet had not been opened; however, the email was not encrypted so there is a small probability that it could have been intercepted in transit. The spreadsheet contained the following types of patient information: Name, address, phone number, email address, date of birth, sex, medical record number, healthcare provider’s name, diagnosis information, and primary insurance carrier.

The investigation into the incident confirmed the error occurred due to the use of the email auto-complete feature. All employees have been provided with HIPAA training, so the employee in question knew the incident was a HIPAA breach and self-reported the error.

The post Data Breaches Reported by Vista Radiology, Indian Creek Foundation & Mankato Clinic appeared first on HIPAA Journal.