The Department of State Hospitals (DSH) in California has discovered an employee accessed the protected health information (PHI) of 1,415 current/former patients and 617 employees without authorization.

The individual had an Information Technology role and had access to data servers containing sensitive patient and employee information in order to complete work duties. The improper access was discovered by DSH on February 25, 2021 during a routine annual review of access to data folders.

An investigation was immediately launched which revealed the employee had been accessing data without authorization for around 10 months. Files containing names, COVID-19 test results, and other health information necessary for tracking COVID-19 were copied directly from the server. The investigation into the privacy breach is ongoing and the employee has been placed on administrative leave pending completion of the investigation. So far, the investigation has not uncovered any evidence to suggest the copied data has been misused or disclosed to any other individual.

DSH explained that safeguards were in place to identify unauthorized PHI access, but since the actions of the employee were identical to legitimate access, the unauthorized access was not identified when it happened and was only discovered during the annual review.

“It appears that the employee used the access they were provided in order to perform their normal job duties to go directly into the server, copy files containing patient, former patient, and employee names, COVID-19 test results, and related health information without any apparent connection to their job duties, indicating a high probability of unauthorized access,” explained DSH in its data breach FAQs. It is currently unclear whether this was an intentional breach.

Steps have since been taken to prevent similar incidents in the future, including changing policies and procedures, limiting access to servers containing PHI, and improving logging and reviews of data activity. Automated detection of files containing PHI being copied to non-standard locations has also been improved.

Mendelson Kornblum Orthopedic and Spine Specialists Discovers Vulnerable Server Containing 28,658 Patients’ PHI

Mendelson Kornblum Orthopedic and Spine Specialists has recently announced that the protected health information of 28,658 patients has been exposed and may have been accessed by unauthorized individuals.

On January 5, 2021, the practice discovered one of its servers was “vulnerable to viewing by unauthorized third parties.” The server contained information such as patient names, medical record numbers, dates of birth, sex of patients, and information relating to medical images, such as the date/time the image was taken, image number, and the name of the body part that was imaged.

No medical images were accessible, nor highly sensitive information such as Social Security numbers, health insurance information, diagnosis/treatment information, or financial information.

While the server was vulnerable to third party access, the investigation did not uncover evidence of any misuse of patient data. Steps have since been taken to prevent similar incidents in the future.

Eyemart Express Alerts Patients to Email Account Breach

Farmers Branch, TX-based Eyemart Express has discovered an unauthorized individual has accessed the email accounts of certain employees and potentially viewed or obtained patients’ protected health information. The breach was discovered on December 11, 2020 and steps were immediately taken to prevent further unauthorized access.

The investigation confirmed the breach started on August 21, 2020 and was limited to email accounts. No internal systems were affected. A comprehensive review of the affected email accounts revealed they contained information such as names, e-mail addresses, and the subject lines of email communications between Eyemart Express and the affected customers. Only a small percentage of its patients have been affected and they have now been notified.

The post California Department of State Hospitals Discovers Unauthorized Data Copying by IT Employee appeared first on HIPAA Journal.

On January 12, 2021, Denver-based Colorado Retina Associates discovered the email account of one of its employees had been accessed by an unauthorized individual who used it to send phishing emails to individuals in the employee’s contact list. The email account was immediately secured and a cybersecurity firm was engaged to investigate the incident to determine the extent of the breach.

That investigation concluded on February 24, 2021 and revealed other email accounts had also been compromised, two of which contained patients’ protected health information. The nature of the attack meant that between January 6, 2021 and January 17, 2021, synching may have occurred. That means the contents of the email accounts may have been copied to the attacker’s device.

A comprehensive review of the email accounts was performed which revealed the protected health information of 26,609 individuals was stored in the accounts. The types of PHI varied from individual to individual may have included full names, date of birth, home addresses, phone numbers, email addresses, dates of service, diagnoses and conditions, labs and diagnostic studies, medications, other treatment or procedure information, and certain health insurance, claims, billing, and payment information.

Fewer than 3% of affected individuals had their Social Security exposed, and fewer than 0.2% of individuals had their driver’s license, financial account, or payment card information exposed.

A password reset was performed across the entire email system and changes have been made to how authorized individuals access email accounts. Security awareness has also been reinforced across the entire workforce.

Affected individuals have now been notified and have been offered 12 months of identity theft protection services.

Walmart Discovers PHI of 2,067 Customers Potentially Compromised in Vendor Breach

On February 16, 2021, Walmart was notified by one of its suppliers about a security incident that may have involved the protected health information of Walmart customers.

The supplier used a data hosting service which was compromised on January 20, 2021. The attackers stole records related to 2,067 Walmart pharmacy customers which included information such as names, dates of birth, addresses, telephone numbers, medication information, prescription numbers, prescriber information, prescription dates, and a very small number of health insurance subscriber ID numbers.

The supplier said it immediately stopped using the data hosting service once it became aware of the breach. Walmart said it is reviewing the security practices of its supplier and will be monitoring the circumstances surrounding the data security event.

The post PHI of 26,600 Individuals Potentially Copied in Colorado Retina Associates Phishing Attack appeared first on HIPAA Journal.

The Portland, OR-based technology and communication solution provider Metro Presort suffered a ransomware attack on May 6, 2019 which resulted in the encryption of files and locked staff out of its systems. The ransomware attack was promptly identified and was contained by May 15, 2019 and the company was able to recover from the attack relatively quickly. An investigation into the attack found no evidence to suggest files were removed from its system, and since the company already encrypted customer data, the attackers would not have been able to access any sensitive information.

In October 2020, Metro Presort reinvestigated the attack and the secondary investigation was unable to confirm that files containing customer data were definitely encrypted before the attack. The invoices, statements, and spreadsheets that Metro presort processed for clients, including healthcare organizations, could potentially have been accessed. An analysis of those files confirmed they contained patient names, addresses, dates of birth, patient and health plan IDs or account numbers, appointment dates, treatment dates, and diagnoses and treatment codes, according to a substitute breach notice published on the Metro Presort website on November 24, 2020.

The incident has recently appeared on the HHS’ Office for Civil Rights website stating the PHI of up to 38,387 individuals may have been compromised. Metro Presort explained in its breach notice that the Department of Health and Human Services’ Office for Civil Rights investigated the breach, Metro Presort’s response, and its policies and procedures, and closed the case on December 31, 2020 after confirming no HIPAA violations had occurred.

“Both before and since this incident, MPI and has devoted considerable resources to maintaining and enhancing its data security, including implementation of the latest technical safeguards to prevent similar incidents, additional protections (encryption) of customer files, and security audits,” explained Metro Presort in its breach notice.

The post Reinvestigation of 2019 Metro Presort Ransomware Attack Reveals PHI May Have Been Compromised appeared first on HIPAA Journal.

PeakTPA, a St. Louis, MO-based provider of health plan management and back-office services, has announced it suffered a cyberattack on or around December 28, 2020 in which protected health information was stolen.

The security incident was detected on December 31 and involved two cloud servers used by the company to manage program of all-inclusive care for the Elderly (PACE) claims.  According to the breach report submitted to the HHS’ Office for Civil Rights, the PHI of up to 50,000 individuals was stolen or exposed.

An investigation into the attack confirmed the attackers obtained full names, home addresses, dates of birth, Social Security numbers, PACE program IDs, and diagnosis and treatment information.

Affected individuals have been notified and offered complimentary membership to credit monitoring, fraud consultation, and identity theft restoration services via Kroll.

St. Bernard’s Total Life Healthcare, Inc., which provides PACE in Northeast Arkansas, and Rocky Mountain Health Care Services in Colorado Springs have confirmed that their patients have been impacted by the attack.

92,000 Individuals Affected by Preferred Home Care of New York Ransomware Attack

Preferred Home Care of New York, a Brooklyn, NY-based provider of in-home care services, experienced a ransomware attack on January 8, 2020 in which patient data was stolen. The attack was detected the following day. According to databreaches.net, samples of data stolen in the attack were uploaded to the Sodinokibi (REvil) data leak site in January.

External counsel for Preferred Home Care of New York explained in a data breach notification that the types of data obtained by the gang varied from individual to individual and may have included names, addresses, email addresses, phone numbers, dates of birth, financial information such as bank account numbers, Social Security numbers and medical information related to health assessments, physicals, drug screens, vaccinations, and TB tests, as well as FMLA and worker’s compensation claims.

92,283 individuals have been notified and complimentary credit monitoring and identity theft protection services have been offered to breach victims.

Newberry County Memorial Hospital Suffers Ransomware Attack

Newberry County Memorial Hospital in South Carolina has announced it suffered a ransomware attack in February that took certain servers out of action, forcing the hospital to switch to manual procedures while the attack was mitigated. The hospital had a full backup of its data and systems and was able to restore all encrypted data without paying the ransom.

The investigation into the attack is ongoing and no evidence has been found of unauthorized data access or data exfiltration to date. The hospital has since taken steps to improve security to prevent similar attacks in the future.

The post Ransomware Gangs Claim Three More Healthcare Victims appeared first on HIPAA Journal.