HIPAA Breach News

Healthcare Data Breaches Up 53% from Q1, 2023

Posted by Steve Alder

Data compromises have increased by 90% compared to Q1, 2023, according to the Q1 2024 Data Breach Report from the Identity Theft Resource Center (ITRC). In Q1, 2024, there were 841 publicly reported data compromises, up from 442 compromises in Q1, 2023. While data compromises almost doubled, there was a 72% fall in the number of victims compared to Q1, 2023, and a drop of 81% from the previous quarter, with 24,474,351 individuals known to have been affected by the 841 data breaches.

In Q1, 2023, healthcare was the most attacked industry; however, in Q1, 2024, healthcare dropped to second place (124 notices and more than 6 million records breached), behind financial services (224 notices and more than 18 million records breached). Healthcare data breaches increased by 53% from Q1, 2023 and were up 69.9% from Q1, 2022; however, the number of victims (6,071,259 individuals) in Q1, 2024, were down 57.2% from Q1, 2023 (14,199,413 individuals). Healthcare placed second in the top 10 compromises of Q1, 2024, with a 2.35 million data breach at Medical Management Resource Group (American Vision Partners), behind LoanDepot which had a breach of more than 16 million records; however, healthcare topped the list with 6 of the 10 largest data breaches in the quarter.

The number of organizations impacted by supply chain attacks more than tripled in Q1 2024 compared to Q1, 2024, with 50 new attacks that affected 243 organizations and involved the data of 7.5 million individuals. In Q1, 2023, 73 entities were affected by supply chain attacks and there were 11.4 million victims. Cyberattacks were the biggest cause of data breaches (642 compromises), followed by phishing/smishing/BEC attacks (108 compromises), and system and human error (85 compromises). It is now increasingly common for data breach notices to not provide information about the cause of the breach. In Q1, 2024, 439 compromises did not state the root cause of the breach (52.2%) compared to 166 of the 442 data compromises (37.6%) in Q1, 2023. More than two-thirds of cyberattack-related data breaches included no information about the root cause of the breach.

“The dramatic increase in data compromises continues to concern us,” said Eva Velasquez, President and CEO of the Identity Theft Resource Center. “However, the decrease in victims impacted is a bit of good news, though still too high. We believe it is due to identity criminals launching more targeted attacks, which differ from tactics used five to ten years ago. With that said, it is critical that businesses and consumers continue to practice good password hygiene and transition to Passkeys when possible.”

The post Healthcare Data Breaches Up 53% from Q1, 2023 appeared first on HIPAA Journal.

Atlanta Women’s Health Group Sued Over 2023 Ransomware Attack

Posted by Steve Alder

Atlanta Women’s Health Group is facing a class action lawsuit over an April 2023 cyberattack that saw an unauthorized third party gain access to its servers and the sensitive data of tens of thousands of its patients. Atlanta Women’s Health Group discovered the attack on April 12, 2023, and its forensic investigation confirmed that patients’ protected health information had been exposed. The types of information involved included names, dates of birth, patient ID numbers, and other information that may be contained in medical records. It was not possible to determine the exact types of information that were accessed or acquired, so notifications were sent to all individuals who had potentially been affected.

A lawsuit – M.T., vs. Atlanta Women’s Health Group P.C. – was filed in the U.S. District Court for the Northern District of Georgia Atlanta Division that alleged the OB/GYN healthcare provider had implemented inadequate data security measures and breached its duties imposed by law. As a result of those failures, unauthorized individuals were able to gain access to its network and steal highly sensitive patient data. Had appropriate cybersecurity measures been implemented, the cyberattack and data breach could have been avoided.

The lawsuit also alleged that while the Department of Health and Human Services’ Office for Civil Rights was notified about the breach within 60 days of discovery, it took Atlanta Women’s Health Group 10 months to issue email notifications to the plaintiff and class members about the attack and did not explain the reason for the delay. The letters stated that all patients were notified about the attack out of an abundance of caution; however, if that is the case, there was no reason to wait 10 months to send the notifications. The lawsuit also stated that the notification letters did not explain when the attack occurred, only when it was detected, and that while Atlanta Women’s Health Group claimed to have obtained evidence that the hackers had deleted the stolen data, the practice has no proof that the data has been permanently erased and copies of that data have not been made by the attackers.

The lawsuit claims the plaintiff and class members have been “exposed to a present injury in the form of actual misuse of their PII and PHI and have further been exposed to an ongoing substantial, heightened, and imminent risk of financial fraud and identity theft for years to come,” and that they have “suffered numerous actual and concrete injuries and damages.” The lawsuit alleges breach of fiduciary duty, negligence, negligence per se, and invasion of privacy/intrusion upon seclusion and seeks class action certification, a jury trial, and declaratory and injunctive relief. The plaintiffs are represented by MaryBeth V. Gibson of the Gibson Consumer Law Group, LLC; Todd McClelland of Sterlington, PLLC; Michael Sullivan, David H. Bouchard, and Gabriel Knisely of Finch McCranie, LLP.

The post Atlanta Women’s Health Group Sued Over 2023 Ransomware Attack appeared first on HIPAA Journal.

Seattle Children’s Hospital Website Tracking Technology Lawsuit Dismissed with Prejudice

Posted by Steve Alder

A class action lawsuit against Seattle Children’s Hospital (SCH) over its use of pixels and other tracking technologies on its website has been dismissed with prejudice by a Washington court. Like many other hospitals, SCH had added pixels to its website which could track user behavior on the site. The tracking technologies were used to gather information on how the website was used to improve the site and patient engagement. Depending on a user’s interactions on the website, the pixels may have captured identifiers and health information, which was transferred to third parties.

A lawsuit was filed by parents who had used the site alleging the addition of pixels violated the Washington Privacy Act, Washington Consumer Protection Act, and Washington Uniform Health Care Information Act. They alleged an invasion of privacy, breach of implied contract, conversion, and unjust enrichment. SCH argued that the information gathered by the pixels did not amount to confidential health information and that users had accepted the terms of its privacy policy and by doing so had consented to having anonymous data shared with third parties. In cases where identifying information was disclosed to third parties, it only occurred because the plaintiffs had that information placed on their browsers by third parties such as Facebook, and not by SCH, and that the plaintiffs had consented to having that identifying information placed on their browsers.

In the lawsuit, the plaintiffs alleged that there had been sensitive interactions on the SCH website, and health information related to those interactions was transmitted to third parties. SCH maintained that the sensitive interactions that were described by the plaintiffs could only happen on its patient portal and that pixels and other tracking technologies were not present on the portal. The Washington court sided with SCH and dismissed all of the plaintiffs’ claims with prejudice.

The post Seattle Children’s Hospital Website Tracking Technology Lawsuit Dismissed with Prejudice appeared first on HIPAA Journal.

Group Health Cooperative of South Central Wisconsin Ransomware Attack Affects 533K Patients

Posted by Steve Alder

Group Health Cooperative of South Central Wisconsin (GHC-SCW) has notified 533,809 patients about a January cyberattack. In the early hours of January 25, 2024, an unauthorized third party accessed its network and attempted to use ransomware to encrypt files. GHC-SCW said the file encryption was not successful; however, while containing the attack and securing its systems, some of its systems were temporarily made unavailable. Third-party cybersecurity experts were engaged to investigate the incident and on February 9, 2024, evidence was uncovered that indicated the attacker had copied certain files from the network before attempting encryption. The attacker also made contact with GHC-SCW and claimed responsibility for the attack and confirmed that data had been exfiltrated from its network. The attacker, a foreign ransomware group, demanded payment to delete the stolen data. GHJC-SCW did not state whether the ransom was paid.

The review of the affected files confirmed that they contained the following types of patient information: Member/patient name, address, telephone number, e-mail address, date of birth and/or date of death, Social Security number, member number, and Medicare and/or Medicaid number.  The types of data involved varied from individual to individual. At the time of issuing notification letters, no evidence had been uncovered suggesting any stolen data had been misused or further disclosed.

GHC-SCW said it notified the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) about the attack and has been working with those agencies to mitigate any harm that may result from the incident. GHC-SCW said cybersecurity measures have been enhanced across all systems and networks to reduce the risk of similar incidents in the future, including strengthening existing privacy and security controls, data backup processes, user training and awareness, and other measures. Affected patients have been offered a one-year membership to a credit monitoring service at no cost.

The post Group Health Cooperative of South Central Wisconsin Ransomware Attack Affects 533K Patients appeared first on HIPAA Journal.

Medusa Ransomware Group Leaks Data Stolen from American Renal Associates

Posted by Steve Alder

The Medusa ransomware group has leaked data stolen from American Renal Associates. Moffitt Cancer Center has been affected by a cyberattack on a vendor, and Family Health Center in Michigan and Zuckerberg San Francisco General Hospital have reported the exposure of patient data.

American Renal Associates

American Renal Associates (ARA), one of the largest providers of dialysis services in the United States and a provider of care for patients suffering from end-stage renal disease has experienced a Medusa ransomware attack. The ransomware attack has yet to be announced by ARA, but the Medusa ransomware group has leaked data allegedly stolen in the attack. The attack occurred on March 2, 2024, and affected hundreds of computers.

According to an analysis of the leaked data by Marco A. De Felice, around 5TB of data was stolen by the Medusa group including the protected health information of an estimated 37,700 patients. The leaked data includes patient names, dates of birth, phone numbers, email addresses, medical records, Social Security numbers, copies of passports and driver’s licenses, health insurance information, and company data.

Moffitt Cancer Center

Moffitt Cancer Center in Florida has announced that it has been affected by a security incident at one of its vendors. The law firm, Gunster, Yoakley, and Stewart, was provided with patient data in connection with legal services provided to Moffitt Cancer Center. Hackers gained access to the law firm’s network and may have obtained data such as names, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, other government-issued identification numbers, financial account information, and medical information, including medical records numbers, health insurance benefit information, claims data, and diagnosis and treatment information.

The law firm started notifying affected individuals in April 2023; however, as the investigation progressed, it became clear that other individuals had been affected. Further notification letters were mailed in the following months, with Moffitt Cancer Center patients notified in April 2024. It is currently unclear how many Moffitt Cancer Center patients have been affected.

Family Health Center

Family Health Center in Kalamazoo, MI, has announced that it fell victim to a cyberattack that caused network disruption and impacted the functionality and access of certain systems. Prompt action was taken to contain the attack and prevent further unauthorized access on January 25, 2024, when the breach was detected and a third-party cybersecurity firm was engaged to conduct a forensic investigation.

The investigation uncovered evidence of unauthorized access to files that contained patient information. The review of those files confirmed that they contained employee information such as names, addresses, health insurance information, and Social Security numbers, and patient information such as first names, last names, and medical information. Family Health Center has reported the breach to the HHS’ Office for Civil Rights as affecting 3,240 individuals and said it has taken steps to improve security, including expanding multi-factor authentication and increasing monitoring of its network for suspicious activity.

Zuckerberg San Francisco General

Zuckerberg San Francisco General in California has announced that a medical logbook went missing in December 2023 that contained patient information. The logbook contained patient data from January 11, 2022, to December 12, 2023, including names, dates of birth, genders, medical record numbers, visit dates, dates of specimen collection, reason for specimen collection, whether a result was received, and other types of health information.

At the time of the announcement, no reports had been received to indicate any misuse of patient data. Zuckerberg San Francisco Hospital is reviewing its policies and procedures and is providing additional security awareness training to employees. The incident has been reported to the HHS’ Office for Civil Rights, but it is not yet shown on the OCR breach portal, so it is unclear how many individuals have been affected.

The post Medusa Ransomware Group Leaks Data Stolen from American Renal Associates appeared first on HIPAA Journal.

Planned Parenthood Los Angeles Settles Class Action Data Breach Lawsuit for $6 Million

Posted by Steve Alder

Planned Parenthood Los Angeles, a provider of reproductive healthcare services in Los Angeles County, has proposed a $6 million settlement to resolve all claims related to a 2021 data breach that exposed the personal information of more than 409,437 patients.

Between October 9, 2021, and October 17, 2021, hackers accessed the Planned Parenthood Los Angeles network, exfiltrated sensitive patient data, and used ransomware to encrypt files. Planned Parenthood discovered the ransomware attack on October 17, 2021, and confirmed on November 4, 2021, that the stolen files contained patient data. The stolen data included names, addresses, dates of birth, diagnoses, health insurance information, and medical information, including procedures and prescriptions.

A lawsuit – In re: Planned Parenthood Los Angeles Data Incident Litigation – was filed in the U.S. District Court of Central California over the data breach that alleged that Planned Parenthood Los Angeles was negligent by failing to implement reasonable and appropriate cybersecurity measures in line with industry standards, and had those measures been implemented, the ransomware attack and data breach could have been avoided. The lawsuit alleged violations of the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA).

According to the lawsuit, the timing of the breach was such that patients would be more likely to suffer harm, as it coincided with Supreme Court debates on abortion. The stolen data also included highly sensitive health information such as abortion procedures, treatment of sexually transmitted diseases, emergency contraception prescriptions, and cancer screening information.

Planned Parenthood Los Angeles chose to settle the lawsuit with no admission of wrongdoing. Claims will be accepted up to a maximum of $10,000 to recover documented losses incurred as a result of the data breach, including bank costs, credit expenses, fraudulent charges, and losses to identity theft and fraud. Class members can also claim up to 7 hours of lost time at $30 per hour and three years of credit monitoring and identity theft protection services, which include a $1 million identity theft protection policy.

Class members will also be entitled to statutory damages, with the payments depending on participation rates. Statutory damages will be paid from the remainder of the $6 million fund after claims have been paid. If there is a 10% participation rate, statutory damages are estimated to be around $66 per class member. Class members are individuals who were notified about the data breach by Planned Parenthood Los Angeles in or around November 2021.

Key Dates:

  • Deadline for objection/exclusion: June 6, 2024
  • Deadline for claims: June 7, 2024
  • Final Hearing: August 8, 2024

The post Planned Parenthood Los Angeles Settles Class Action Data Breach Lawsuit for $6 Million appeared first on HIPAA Journal.

Planned Parenthood Los Angeles Settles Class Action Data Breach Lawsuit for $6 Million

Posted by Steve Alder

Planned Parenthood Los Angeles, a provider of reproductive healthcare services in Los Angeles County, has proposed a $6 million settlement to resolve all claims related to a 2021 data breach that exposed the personal information of more than 409,437 patients.

Between October 9, 2021, and October 17, 2021, hackers accessed the Planned Parenthood Los Angeles network, exfiltrated sensitive patient data, and used ransomware to encrypt files. Planned Parenthood discovered the ransomware attack on October 17, 2021, and confirmed on November 4, 2021, that the stolen files contained patient data. The stolen data included names, addresses, dates of birth, diagnoses, health insurance information, and medical information, including procedures and prescriptions.

A lawsuit – In re: Planned Parenthood Los Angeles Data Incident Litigation – was filed in the U.S. District Court of Central California over the data breach that alleged that Planned Parenthood Los Angeles was negligent by failing to implement reasonable and appropriate cybersecurity measures in line with industry standards, and had those measures been implemented, the ransomware attack and data breach could have been avoided. The lawsuit alleged violations of the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA).

According to the lawsuit, the timing of the breach was such that patients would be more likely to suffer harm, as it coincided with Supreme Court debates on abortion. The stolen data also included highly sensitive health information such as abortion procedures, treatment of sexually transmitted diseases, emergency contraception prescriptions, and cancer screening information.

Planned Parenthood Los Angeles chose to settle the lawsuit with no admission of wrongdoing. Claims will be accepted up to a maximum of $10,000 to recover documented losses incurred as a result of the data breach, including bank costs, credit expenses, fraudulent charges, and losses to identity theft and fraud. Class members can also claim up to 7 hours of lost time at $30 per hour and three years of credit monitoring and identity theft protection services, which include a $1 million identity theft protection policy.

Class members will also be entitled to statutory damages, with the payments depending on participation rates. Statutory damages will be paid from the remainder of the $6 million fund after claims have been paid. If there is a 10% participation rate, statutory damages are estimated to be around $66 per class member. Class members are individuals who were notified about the data breach by Planned Parenthood Los Angeles in or around November 2021.

Key Dates:

  • Deadline for objection/exclusion: June 6, 2024
  • Deadline for claims: June 7, 2024
  • Final Hearing: August 8, 2024

The post Planned Parenthood Los Angeles Settles Class Action Data Breach Lawsuit for $6 Million appeared first on HIPAA Journal.

Contract Class Certified in CareFirst Data Breach Lawsuit 9 Years After Legal Action was Initiated

Posted by Steve Alder

A lawsuit against CareFirst BlueCross BlueShield that was filed in response to a 2014 data breach has had a contract class certified by a federal judge, 9 years after legal action was initiated. The lawsuit can now proceed and more than 1 million plan members are a step closer to obtaining damages. In June 2014, hackers gained access to CareFirst systems, which contained the data of around 1.1 million plan members; however, the intrusion was not detected for several months. In response to major data breaches at Anthem Inc., Premera, Excellus, and Community Health Systems, CareFirst conducted a review of its systems which reviewed there had been unauthorized access to one of its databases.

CareFirst announced the data breach in May 2015 and explained that a single database was compromised that stored data that members and other individuals enter to access CareFirst’s websites and online services. The compromised data included names, birth dates, email addresses, and subscriber ID numbers, but no highly sensitive information such as Social Security numbers, financial information, or health information.

A lawsuit – Chantal Attias, et al. vs. CareFirst  – was filed in the U.S. District Court for the District of Columbia shortly after the notification letters were mailed that alleged injuries had been suffered as a result of the breach. The lawsuit, which named seven policyholders as plaintiffs, alleged breach of contract and violations of the Consumer Protection Acts in Maryland and Virginia. The lawsuit was dismissed in 2016 due to a lack of standing, as the plaintiffs failed to allege a concrete, identifiable injury had been sustained as a result of the breach. The ruling was appealed, and the District Court’s ruling was overturned. In 2018, the Supreme Court declined a review of the case, which was referred back to the District Court, then followed several years of back-and-forth litigation. In 2022, the plaintiffs moved to certify three classes, one for each cause of action; however, in March 2023, District Court Judge Christopher Cooper denied the plaintiffs’ motion to certify two consumer classes and one contract class without prejudice, allowing the plaintiffs to file a renewed and modified motion which they did.

In late 2023, CareFirst’s motion for summary judgment was partially granted, and the claims under the consumer protection statutes in Maryland and Virginia were dismissed. The court found that the plaintiffs could not show there had been any identity theft, and under Washington D.C. law, mitigation expenses incurred to abate the risk of future fraud do not qualify as actual damages, therefore the plaintiffs would only be able to recover nominal damages.

On March 29, 2023, after careful consideration and a hearing on the matter, Judge Cooper found that certification of a contract class was warranted. “The standing issue that prevented the Court from certifying the last go around has since dissolved because, as all sides agree, each member of the proposed class has allegedly suffered a concrete injury based on CareFirst’s supposed breach of its contractual obligation to safeguard its customers’ data—regardless of whether they sustained an additional, tangible injury due to the data breach,” wrote Judge Cooper in his ruling.

The contract class consists of all individuals in the District of Columbia, Maryland, or Virginia who purchased or possessed health insurance from CareFirst, had their sensitive data exposed in the data breach, and were notified about that breach by CareFirst in May 2015.

The post Contract Class Certified in CareFirst Data Breach Lawsuit 9 Years After Legal Action was Initiated appeared first on HIPAA Journal.

Data Breach at New York Medical Billing Service Provider Affects 284K Individuals

Posted by Steve Alder

M&D Capital Premier Billing in Queens, NY, has announced a breach of the protected health information of 284,326 individuals. Data breaches have also been reported by Tri-City Healthcare District and Dental Health Services in California, and Ethos (Southwest Boston Senior Services) in Massachusetts.

M&D Capital Premier Billing

M&D Capital Premier Billing, a Queens, NY-based billing service provider, has notified 284,326 individuals about a cybersecurity incident identified on July 8, 2023. Suspicious activity was detected within its network and third-party cybersecurity specialists were engaged to investigate the nature and scope of the unauthorized activity. The forensic investigation confirmed that an unauthorized third party gained access to its network on June 20, 2023, and maintained access until July 8, 2023.

During those three weeks, protected health information provided by its covered entity clients may have been viewed or acquired. That information may have included names, addresses, dates of birth, Social Security numbers, financial information, medical billing information, insurance information, and medical information such as diagnoses, medication, and treatments. M&D Capital Premier Billing said it has reviewed its existing policies and procedures and has implemented additional administrative and technical safeguards to help prevent future attacks. The affected individuals have been offered single bureau credit monitoring/single bureau credit report/single bureau credit score services at no cost.

Ethos (Southwest Boston Senior Services)

Ethos, aka Southwest Boston Senior Services, has recently announced a cybersecurity incident that occurred on November 18, 2023, that exposed the protected health information of 14,503 individuals. On March 13, 2024, it was confirmed that protected health information had potentially been accessed or acquired in the incident. For most of the affected individuals, the exposed data included names, addresses, medical insurance information, and health and treatment information. A small group of affected individuals also had their Social Security numbers exposed.

Contact information has now been verified, which will allow individual notifications to be mailed to the affected individuals. Ethos did not state in its website notification whether credit monitoring and identity theft protection services are being offered. The notification letters will explain the steps that affected individuals can take to monitor and protect their information.

Tri-City Healthcare District

Tri-City Healthcare District in California has notified 7,847 individuals about the exposure of some of the protected health information. On November 9, 2023, unusual activity was detected in its systems, which disrupted access to those systems. The forensic investigation confirmed that an unauthorized third party gained access to its network on November 8, 2023, and may have viewed or exfiltrated files containing patient data.

The review of the affected files was completed on or around March 7, 2024, and confirmed that names and Social Security numbers had been exposed. Notification letters were sent to the affected individuals on April 4, 2024, and complimentary identity theft protection services have been offered. Tri-City Healthcare District said it has implemented additional security measures to further harden security and prevent similar incidents in the future.

Dental Health Services

Dental Health Services, a Californian provider of dental health plans to individuals in California, Oregon, and Washington, has notified certain plan members about an impermissible disclosure of some of their protected health information. On or around February 7, 2024, an error resulted in monthly invoices mistakenly being emailed to certain employer group customers that contained plan member data. While the invoices were encrypted and password protected, before the error was identified, the email recipients were sent the encryption password in a separate email, which allowed the invoices to be viewed.

The invoices contained the impacted members’ names, dates of birth, member identification numbers, eligibility dates, plan types, and premium amounts due. Dental Health Services has received assurances from all recipients of the emails that the incorrectly disclosed invoices have been deleted. Due to the nature of the disclosed information, Dental Health Services does not believe the data will be misused.

The post Data Breach at New York Medical Billing Service Provider Affects 284K Individuals appeared first on HIPAA Journal.