Grand River Medical Group in Dubuque, OH has discovered an unauthorized individual gained access to the email account of an employee and may have viewed or obtained the protected health information of 34,000 patients.

Upon discovery of the breach, a password reset was performed to prevent any further unauthorized access and an internal investigation was launched to determine whether any other systems were breached. The Grand River Medical Group IT team confirmed that only one email account was compromised and no other systems were accessed.

Third-party breach response experts were engaged to conduct a forensic analysis to determine whether any patient information in the email account was viewed or exfiltrated. It was not possible to rule out data theft, although no evidence was found to indicate patient data was stolen in the attack.

The information in the email account varied from patient to patient and included one or more of the following types of protected health information in addition to patient names: Address, date of birth, patient’s balance and balance type, visit type, claim amount and status code, medications, and guarantor’s name. Some Social Security numbers were also exposed.

Notifications were sent to affected patients between February 8 and February 11, 2021. Affected individuals have been offered a complimentary 12-month membership to credit monitoring and identity theft recovery services through MyIDCare, which includes a $1,000,000 identity theft insurance policy.

PHI of 15,600 Patients Potentially Compromised in Granite Wellness Centers Ransomware Attack

Granite Wellness Centers in Northern California suffered a ransomware attack on January 5, 2021 in which patient information was encrypted. The attack was detected while it was in progress and systems were taken offline to prevent the exfiltration of data.

A ransom remand was issued, but no ransom was paid. Granite Wellness Centers was able to restore all encrypted files from backups. A review of the systems affected revealed they contained patient data such as names, dates of birth, dates of service, treatment and health information, treatment provider, and health insurer name.

Granite Wellness Centers has not received any reports that indicate patient information has been misused; however, affected individuals have been advised to monitor their accounts and explanation of benefits statements for suspicious activity. Additional safeguards are being implemented to prevent further cyberattacks and to secure data stored on its systems.

The PHI of up to 15,600 individuals was potentially compromised in the attack.

Texas Spine Consultants Security Breach Impacts 25,728 Patients

Texas Spine Consultants in Addison, TX has discovered a security incident which resulted in the inadvertent disclosure of the protected health information of 25,728 patients. The security incident occurred on December 2, 2020 and is still under investigation, but it does not appear that the disclosure was linked to hackers or criminal activity.

The information inadvertently disclosed was limited to patients’ names, dates of birth, and image scans. Texas Spine Consultants has notified affected individuals by mail and has provided information to help them protect themselves against fraudulent activity. Additional privacy and security measures have now been implemented to prevent further data breaches in the future.

Southern California Center for Anti-Aging Discovers Email Account Breach

The Southern California Center for Anti-Aging in Torrance, CA has discovered an unauthorized individual gained access to an employee’s email account and may have viewed or downloaded patient information.

The breach was detected on December 9, 2020 and access to the email account was immediately blocked. A review of the compromised account revealed it contained patient names along with limited clinical information about the care provided at the Southern California Center for Anti-Aging.

The Southern California Center for Anti-Aging has implemented additional security measures to prevent further breaches in the future and all affected individuals have been notified by mail.

PHI Potentially Obtained in Gastroenterology Consultants Hacking Incident

Gastroenterology Consultants in Reno, NV is notifying 2,500 patients about a data security incident that occurred on December 8, 2020. A hacker gained access to a server and potentially obtained files containing patient names, addresses, contact telephone numbers, and other personally identifiable information.

A forensic investigation was conducted by a third-party security firm and it appears that files were exfiltrated from the server. Additional cybersecurity measures have now been implemented to prevent further breaches in the future.

The post Grand River Medical Group Email Breach Impacts 34,000 Patients appeared first on HIPAA Journal.

Two more healthcare providers have suffered ransomware attacks in which sensitive information was exfiltrated and leaked online when the ransom was not paid.

The Conti ransomware gang has published data on its leak site which was allegedly obtained in an attack on Rehoboth McKinley Christian Health Care Services in New Mexico. The leaked data includes sensitive patient information including scanned patient ID cards, passports, driver’s license numbers, diagnoses, treatment information, and diagnostic reports.

It is unclear how many patients have had their PHI exposed so far. The Conti ransomware gang claims it has only published around 2% of the data stolen in the attack.

The latest data leak by the Conti ransomware gang follows similar leaks of the data stolen in the ransomware attacks on Leon Medical Centers in Florida and Nocona General Hospital in Texas.

The Avaddon ransomware gang has similarly published data on its leak site that was stolen in an attack on Capital Medical Center in Olympia in Washington. The gang has threatened to leak further data within the next few days if the ransom is not paid. The leaked data includes driver’s license numbers, patient documents, diagnosis and treatment information, insurance information, lab test results, prescriptions, provider names, and patient contact information.

According to Emsisoft, there are currently at least 17 ransomware gangs engaging in data exfiltration prior to file encryption, all of which threaten to release or sell the stolen data if the ransom is not paid.  The latest Coveware ransomware report suggests data exfiltration occurs in around 70% of ransomware attacks. These double extortion attacks often see the ransom paid to prevent the release of stolen data, but there are signs that this tactic is becoming less effective due to a lack of trust that the threat groups will delete stolen data if the ransom is paid.

There have been several cases where payment has been made, only for further extortion demands to be made or for stolen data to still be published on leak sites.

Hacker Potentially Obtained Patient Data from Sutter Buttes Imaging Medical Group

Sutter Buttes Imaging Medical Group (SBIMG) in Yuba City, CA has discovered an unauthorized individual has gained access to third -party IT hardware used at its Yuba City imaging center and potentially viewed and obtained limited patient data.

In December 2020, SBIMG learned that a hacker exploited an unpatched vulnerability in IT hardware that was used to store and transmit information in connection with medical services provided to patients. Action was immediately taken to expel the hacker from its systems and secure patient data. An investigation into the incident revealed the hacker first gained access to the IT hardware in July 2019, and access remained possible until December 2020.

An investigation into the security breach showed the attacker had access to limited patient information such as names, dates of birth, imaging procedure performed, study date, study name, and internal patient/study numbers. No financial information, insurance information, or Social Security numbers were compromised.

SBIMG has corrected the vulnerability and other steps have been taken to improve security to prevent similar breaches in the future, including closing certain firewall ports. Third-party security experts have been engaged to assess system security and additional security controls are now being implemented.

All patients have been notified by mail and the breach has been reported to the HHS’ Office for Civil Rights. The incident has yet to appear on the HHS breach portal, so it is currently unclear exactly how many individuals have been affected.

The post Ransomware Gangs Leak Sensitive Data Stolen from Capital Medical Center and Rehoboth McKinley Christian Health Care Services appeared first on HIPAA Journal.

An email error by an employee of Campbell County Health (CCH) has resulted in the impermissible disclosure of the protected health information of 900 individuals. The Gillette, WY-based health system discovered on February 5, 2021 that an employee sent an email to a patient and attached an incorrect file.

The file contained patient names, account numbers, and their type of insurance. The email error was discovered within an hour of the email being sent and the recipient was immediately contacted and was told to securely delete the attachment. CCH officials provided instructions on how to ensure that the file was permanently deleted from the email account and all devices, and CCH has received satisfactory assurances that the file has now been permanently deleted and no further disclosures were made.

Affected individuals have been notified about the incident and internal policies are being revised to prevent similar incidents in the future. CCH has also provided further training to employees on best practices for protecting patient data.

UT Southwestern Medical Center Alerts Patients About Impermissible PHI Disclosure

UT Southwestern Medical Center in Dallas, TX is notifying 3,640 patients about an inappropriate disclosure of their names and email addresses to a third-party vendor.  The information was shared with the third-party vendor in order to send invitations to a Kidney Cancer Program event. No other information was disclosed. All affected patients had previously received medical services through the UTSW Kidney Cancer Program.

The information was not further disclosed or compromised, but the sharing of the patient information was not permitted under HIPAA, hence the need to notify patients. UTSW Medical Center said, “UT Southwestern considers the protection of our patients’ privacy of utmost importance, and we deeply regret the occurrence of this incident and any worry, distress, or difficulty that it may cause.”

The post Email Error Results in Impermissible Disclosure of the PHI of 900 Campbell County Health Patients appeared first on HIPAA Journal.