The protected health information of patients of University of Miami Health has been obtained by unauthorized individuals in a ransomware attack on the file transfer service provider Accellion.

University of Miami Health used Accellion’s file transfer technology for sharing files that were too large to send via email. The University of Miami said the Accellion solution was only used by a small number of individuals at the university and prompt action was taken to contain the incident. The university has since stopped using Accellion’s file transfer services.

The investigation into the attack is ongoing and the analysis of the files that were obtained or potentially compromised in the attack has not yet been completed, so it is not yet known exactly how many individuals have been affected.

The University of Miami does not believe any of its systems were compromised in the attack with the breach believed to be limited to files sent or received through Accellion’s file transfer solution.

The gang behind the attack demanded a $10 million ransom for the keys to decrypt data and avoid having data published online or sold on dark web marketplaces. Some of the data stolen in the attack has already been posted on the gang’s leak site, including some data relating to patients of University of Miami Health.

The University of Miami was one of several Accellion customers to be affected by the breach, including the University of Colorado, Kroger, Centene, Arizona Complete Health, and Shell Oil.

1,612 Dental Plan Members Affected by Mott Community College Ransomware Attack

Mott Community College has notified 1,612 individuals that files containing their protected health information were obtained by unauthorized individuals prior to the use of ransomware on its systems.

When the attack was discovered, a third-party cybersecurity firm was engaged to assist with the investigation to determine the extent of the security breach. The analysis revealed attackers gained access to its network on November 27, 2020 and access remained possible until January 9, 2021.

On January 23, 2021 Mott Community College discovered that sensitive data had been exfiltrated by the attackers prior to the use of ransomware, and that some of the files related to individuals covered under its self-insured dental plan. A review of those files confirmed they included names, dates of birth, and dental plan enrollment and claims information for individuals covered by the dental plan in 2014-2015, and 2019.

Notification letters were sent to all individuals affected starting on March 24, 2021. While data exfiltration was confirmed, it does not mean the contents of the files were viewed, misused, or further disclosed. Mott Community College has now implemented additional safeguards and technical security measures to prevent any further attacks, including multifactor authentication for all network and email access and additional password requirements.

The post University of Miami Health and Mott Community College Data Compromised in Ransomware Attacks appeared first on HIPAA Journal.

Cancer Treatment Centers of America is alerting 104,808 patients of its Midwestern Regional Medical Center that some of their protected health information was contained in an email account that was accessed by an unauthorized individual.

Suspicious activity was identified in a CTCA account holder’s account on January 18, 2021. The account was immediately secured to prevent further unauthorized access and a third-party forensics firm was engaged to assist with the investigation and determine the nature and scope of the breach.

The investigation revealed the email account was accessed on January 12, 2021 and access remained possible until January 18 when a password reset was performed. It was not possible to confirm which emails, if any, were accessed, nor was it possible to rule out data theft.

A review of the compromised account revealed it contained patient names, health insurance information, medical record numbers, CTCA account numbers, and limited medical information. No financial information or Social Security numbers were compromised.

CTCA has implemented additional security measures to prevent further breaches and additional security enhancements are being evaluated. Notifications were sent to affected individuals on March 18, 2021.

Vendor Breach Affects More than 9,000 Insulet Patients

The Acton, MA-based medical device company Insulet Corporation is alerting 9,050 patients about a data breach at an online customer training vendor – Cornerstone On-Demand.

Insulet was notified around January 19, 2020 that an unauthorized individual had gained access to Cornerstone’s systems on January 13, 2021 and potentially downloaded data that included the protected health information of Insulet patients.

Data stored on the compromised system included names, email addresses, Insulet customer training records, and online course information. When Cornerstone identified the breach, its systems were immediately secured to prevent further unauthorized access. Additional security measures have since been implemented to prevent further attacks. Insulet said it has begun transitioning to a new online training vendor and will order Cornerstone to delete all its data once the transition has been completed.

The post Cancer Treatment Centers of America Announces 105,000-Record Data Breach appeared first on HIPAA Journal.

Mobile Anesthesiologists has recently discovered a limited amount of patients’ protected health information (PHI) has been exposed due to a technical misconfiguration. The error was determined to have occurred prior to December 14, 2020, and made PHI such as names, health insurance information, date of service, medical procedure, and dates of birth publicly accessible.

An investigation into the error was concluded on January 28, 2021 and confirmed that the PHI of 65,403 individuals had been exposed. While the PHI could potentially have been accessed by unauthorized individuals, no evidence of unauthorized data access or PHI misuse was discovered. Affected individuals were notified by mail starting March 10, 2021.

Haven Behavioral Healthcare Announces Breach of Systems Containing Patient Data

Nashville, TN-based Haven Behavioral Healthcare has announced that unauthorized individuals gained access to parts of its network that contained the protected health information of patients. The breach was detected on or around September 27, 2020. An investigation was immediately launched, and third-party cybersecurity experts were engaged to determine the nature and scope of the breach.

The investigation revealed its systems were subjected to unauthorized access between September 24 and September 27, 2020 and, on January 27, 2021, it was determined files on those systems contained patient information. A review of the files was completed on March 11, 2021 and notification letters started to be sent on March 23, 2021.

While the files were accessible, the investigation was unable to determine if the files were accessed. It is currently unclear which hospitals and how many patients have been affected.

Email Error Results in Unauthorized Disclosure of Heart of Texas Community Health Center Patients

Heart of Texas Community Health Center has discovered the protected health information of a limited number of patients has been exposed.

An email containing patient data was sent to individuals authorized to view the information, but the email was sent to an account that was outside the protection of the firewall so could potentially have been intercepted as the email was not encrypted.

The email only included an email address and indicated the email account holder was overdue a pap smear. No names or other information were included in the email. The email only related to female patients aged 21 to 65 years of age who were seen at a Heart of Texas Community Health Center site between September and December 2020.

No reports have been received to indicate the email was intercepted or otherwise accessed by unauthorized individuals.

The post Misconfiguration Resulted in Exposure of the PHI of 65,000 Mobile Anesthesiologists Patients appeared first on HIPAA Journal.

The Department of State Hospitals (DSH) in California has discovered an employee accessed the protected health information (PHI) of 1,415 current/former patients and 617 employees without authorization.

The individual had an Information Technology role and had access to data servers containing sensitive patient and employee information in order to complete work duties. The improper access was discovered by DSH on February 25, 2021 during a routine annual review of access to data folders.

An investigation was immediately launched which revealed the employee had been accessing data without authorization for around 10 months. Files containing names, COVID-19 test results, and other health information necessary for tracking COVID-19 were copied directly from the server. The investigation into the privacy breach is ongoing and the employee has been placed on administrative leave pending completion of the investigation. So far, the investigation has not uncovered any evidence to suggest the copied data has been misused or disclosed to any other individual.

DSH explained that safeguards were in place to identify unauthorized PHI access, but since the actions of the employee were identical to legitimate access, the unauthorized access was not identified when it happened and was only discovered during the annual review.

“It appears that the employee used the access they were provided in order to perform their normal job duties to go directly into the server, copy files containing patient, former patient, and employee names, COVID-19 test results, and related health information without any apparent connection to their job duties, indicating a high probability of unauthorized access,” explained DSH in its data breach FAQs. It is currently unclear whether this was an intentional breach.

Steps have since been taken to prevent similar incidents in the future, including changing policies and procedures, limiting access to servers containing PHI, and improving logging and reviews of data activity. Automated detection of files containing PHI being copied to non-standard locations has also been improved.

Mendelson Kornblum Orthopedic and Spine Specialists Discovers Vulnerable Server Containing 28,658 Patients’ PHI

Mendelson Kornblum Orthopedic and Spine Specialists has recently announced that the protected health information of 28,658 patients has been exposed and may have been accessed by unauthorized individuals.

On January 5, 2021, the practice discovered one of its servers was “vulnerable to viewing by unauthorized third parties.” The server contained information such as patient names, medical record numbers, dates of birth, sex of patients, and information relating to medical images, such as the date/time the image was taken, image number, and the name of the body part that was imaged.

No medical images were accessible, nor highly sensitive information such as Social Security numbers, health insurance information, diagnosis/treatment information, or financial information.

While the server was vulnerable to third party access, the investigation did not uncover evidence of any misuse of patient data. Steps have since been taken to prevent similar incidents in the future.

Eyemart Express Alerts Patients to Email Account Breach

Farmers Branch, TX-based Eyemart Express has discovered an unauthorized individual has accessed the email accounts of certain employees and potentially viewed or obtained patients’ protected health information. The breach was discovered on December 11, 2020 and steps were immediately taken to prevent further unauthorized access.

The investigation confirmed the breach started on August 21, 2020 and was limited to email accounts. No internal systems were affected. A comprehensive review of the affected email accounts revealed they contained information such as names, e-mail addresses, and the subject lines of email communications between Eyemart Express and the affected customers. Only a small percentage of its patients have been affected and they have now been notified.

The post California Department of State Hospitals Discovers Unauthorized Data Copying by IT Employee appeared first on HIPAA Journal.