An email error by an employee of Campbell County Health (CCH) has resulted in the impermissible disclosure of the protected health information of 900 individuals. The Gillette, WY-based health system discovered on February 5, 2021 that an employee sent an email to a patient and attached an incorrect file.

The file contained patient names, account numbers, and their type of insurance. The email error was discovered within an hour of the email being sent and the recipient was immediately contacted and was told to securely delete the attachment. CCH officials provided instructions on how to ensure that the file was permanently deleted from the email account and all devices, and CCH has received satisfactory assurances that the file has now been permanently deleted and no further disclosures were made.

Affected individuals have been notified about the incident and internal policies are being revised to prevent similar incidents in the future. CCH has also provided further training to employees on best practices for protecting patient data.

UT Southwestern Medical Center Alerts Patients About Impermissible PHI Disclosure

UT Southwestern Medical Center in Dallas, TX is notifying 3,640 patients about an inappropriate disclosure of their names and email addresses to a third-party vendor.  The information was shared with the third-party vendor in order to send invitations to a Kidney Cancer Program event. No other information was disclosed. All affected patients had previously received medical services through the UTSW Kidney Cancer Program.

The information was not further disclosed or compromised, but the sharing of the patient information was not permitted under HIPAA, hence the need to notify patients. UTSW Medical Center said, “UT Southwestern considers the protection of our patients’ privacy of utmost importance, and we deeply regret the occurrence of this incident and any worry, distress, or difficulty that it may cause.”

The post Email Error Results in Impermissible Disclosure of the PHI of 900 Campbell County Health Patients appeared first on HIPAA Journal.

Nebraska Medicine has started notifying approximately 219,000 patients about a malware attack that allowed an unauthorized individual to view and obtain patient information.

Nebraska Medicine identified unusual activity in some of its systems on September 20, 2020. All affected devices were isolated to contain the breach and impacted systems were shut down to prevent any further unauthorized access. Independent computer forensics experts were engaged to conduct an investigation and determine the nature and scope of the security breach.

The investigation confirmed that an unauthorized individual first gained access to the network on August 27, 2020 and deployed malware. Between August 27 and September 20, that individual copied certain files, some of which contained patient information.

The files contained information about patients who received medical services at The Nebraska Medical Center or University of Nebraska Medical Center, as well as a limited number of patients who visited Faith Regional Health Services, Great Plains Health, or Mary Lanning Healthcare.

The protected health information obtained in the attack included one or more of the following data elements: Name, address, date of birth, medical record number, health insurance information, physician notes, laboratory results, imaging, diagnosis information, treatment information, and/or prescription information, and a limited number of Social Security numbers and driver’s license numbers.

Affected individuals were notified about the breach on February 5, 2021. Individuals whose Social Security or driver’s license number was compromised have been offered complimentary credit monitoring and identity theft protection services. Nebraska Medicine continues to monitor its IT environment for potential breaches and network monitoring tools have been enhanced.

Phishing Attack Affects 2,500 Hackley Community Care Patients

Hackley Community Care in Muskegon, MI is alerting approximately 2,5000 patients that some of their protected health information has been exposed and may have been viewed by unauthorized individuals.

In September 2020, a phishing email was sent to several staff members that contained a link to a malicious website. One employee clicked the link and entered their login credentials which were captured and used by the attacker to remotely access the employee’s email account between September 7 and September 24, 2020.

The investigation into the incident confirmed only one email account had been compromised and no evidence was found to indicate any emails in the account were opened. A review of the compromised email account was completed on December 18, 2020 and all individuals are now being notified if they have been affected.

For most of the affected individuals, the breach was limited to names and addresses. Individuals who had more sensitive data exposed have been offered complimentary credit monitoring services through TransUnion. Hackley Community Care is implementing additional security measures to prevent similar incidents in the future.

The post Nebraska Medicine Notifies 219,000 Patients About September 2020 Malware Attack appeared first on HIPAA Journal.

University of Pittsburgh Medical Center (UPMC) has announced the protected health information of more than 36,000 patients has potentially been accessed by unauthorized individuals following a cyberattack on a company that provides billing-related legal services to UPMC.

In June 2020, Charles J. Hilton & Associates P.C. (CJH) discovered suspicious activity in its employee email system and launched an investigation. On July 21, 2020, CJH determined that hackers had gained access to the email accounts of several of its employees between April 1, 2020 and June 25, 2020.

Computer forensics specialists conducted an extensive investigation into the incident to determine which information was accessed or obtained by the hackers. UPMC said it received a notification about the breach in December 2020 confirming patient information may have been accessed by the hackers. Notification letters are now being sent by CJH to all patients potentially affected by the breach. UPMC said none of its systems, including its electronic medical record system, were affected, and the only information involved was patient information provided to CJH to provide its contracted billing-related legal services.

CJH said the compromised accounts contained names, dates of birth, Social Security numbers, bank or financial account numbers, driver’s license numbers, state identification card numbers, electronic signatures, medical record numbers, patient account numbers, patient control numbers, visit numbers, trip numbers, Medicare or Medicaid identification numbers, individual health insurance or subscriber numbers, group health insurance or subscriber numbers, medical benefits and entitlement information, disability access and accommodation, and information related to occupational-health, diagnosis, symptoms, treatment, prescription or medications, drug tests, billing or claims, and/or disability.

CJH is offering complimentary membership to credit monitoring and identity theft protection services to affected individuals.

UPMC Health Plan Phishing Incident Impacts 19,000 Members

19,000 members of UPMC Health Plan are being notified that some of their protected health information has potentially been compromised. An email account of a UPMC Health Plan employee was accessed by an unauthorized individual on December 8, 2020. UPMC Health Plan was notified about the breach the following day.

The information stored in the compromised email account only included names, dates of birth, parent/guardian names, and limited clinical information, including dental provider and procedure information. No evidence was found to indicate any plan member information has been misused.

This phishing attack does not appear to be in any way connected to the phishing attack at Charles J. Hilton & Associates P.C.

Nevada Health Centers Alerts Patients About Email Account Breach

Nevada Health Centers has announced that the protected health information of some of its patients has potentially been compromised. Between November 20 and December 7, 2020, an unauthorized individual remotely logged into an employee’s email account that contained patient information.

The person who logged into the account appeared to be based overseas, with one of the login attempts made using a South African IP address. The attack appears to have been conducted to obtain financial information about Nevada Health Centers rather than patient health data, although it is possible that patient information was viewed or obtained in the attack. Nevada Health Centers said no evidence of PHI access or theft has been found.

The compromised email account was discovered to contain patient names in combination with one or more of the following types of information: Address, phone number, date of birth, gender, ethnicity, race, insurance information, appointment information, medical record number, provider name, service location(s). It is currently unclear how many patients have been affected by the breach.

The post Email Account Breach at Law Firm Affects More Than 36,000 UPMC Patients appeared first on HIPAA Journal.

The County Manager’s Office of Ramsey County, MN has started notifying 8,700 clients of its Family Health Division that some of their personal information has potentially been accessed by unauthorized individuals in a ransomware attack on one of its vendors.

St. Cloud-based Netgain Technology LLC provides technology services to Ramsey County, including an application used by the Family Health Division for documenting home visits. Data within that application was potentially accessed and exfiltrated by threat actors prior to the deployment of ransomware.  The application contained information such as names, addresses, dates of birth, dates of service, telephone numbers, account numbers, health insurance information, medical information and, for a small number of individuals, Social Security numbers.

The attack appears to have been conducted with the sole purpose of extorting money from Netgain rather than to gain access to personal information; however, it was not possible to rule out unauthorized access or data theft.

Ramsey County was notified about the attack on December 2, 2020 and immediately stopped using Netgain’s services and applications and switched to backup processes. The attack has been reported to the law enforcement and steps are being taken to harden security to prevent further attacks.

Crisp Regional Health Services Hit with Ransomware Attack

Cordele, GA-based Crisp Regional Health Services has suffered a ransomware attack on January 27, 2020 that has forced certain systems offline. The attack disabled the hospital’s telephone system and staff had to resort to radios for internal communication. Patients and their family members were advised to make contact via social media while the phone system was down.

Steps were immediately taken to secure information and contain the attack and third-party cybersecurity professionals have been engaged to assist with the investigation and determine the extent and scope of the breach, and whether the attackers accessed or exfiltrated patient data.

Crisp Regional Health Services’ community relations and foundation director, Brooke Marshall, said “Workflow was never compromised, patient care was never compromised.”

The investigation is ongoing and further information will be released as and when it becomes available.

Vulnerability in Vaccine Scheduling Tool Allowed Individuals to Cut in Line and Book Vaccination Appointments

Beaumont Health in Michigan experienced a breach of its Epic COVID-19 vaccine scheduling application over the weekend of January 30/31. An unauthorized individual exploited a vulnerability in the platform and publicly shared an unauthorized scheduling pathway. That pathway was subsequently used by 2,700 individuals to book COVID-19 vaccination appointments.

Beaumont Health notified Epic about the incident on January 31, 2020 and both worked together to address the issue. All 2,700 individuals who cut in line have had their vaccination appointment cancelled. Individuals who met the eligibility criteria and booked legitimate appointments for a COVID-19 vaccination have not been affected.

Epic issued a statement confirming that the incident did not result in any unauthorized individuals gaining access to patients medical or hospital records.

The post Ramsey County and Crisp Regional Health Services Affected by Ransomware Attacks appeared first on HIPAA Journal.