A round up of healthcare phishing attacks that have been publicly disclosed in the past few days.

2,254 Patients Affected by Leonard J. Chabert Medical Center Email Account Breach

Leonard J. Chabert Medical Center has been notified that the protected health information of some of its patients has been compromised in a phishing attack on LSU Health New Orleans Health Care Services Division (LSU HCSD).

LSU HCSD announced the breach publicly on November 20, 2020 but discovered on November 24, 2020 that some patient data from Leonard J. Chabert Medical Center, its partner hospital, had also potentially been compromised.

Leonard J. Chabert Medical Center was provided with information related to the breach on December 3, 2020, the analysis of which revealed the protected health information of 2,254 patients had been exposed between September 15, 2020 to September 18, 2020.

For most patients, the exposed data was limited to names, phone numbers, addresses, medical record numbers, dates of birth, account numbers, dates of service, types of services received, and health insurance identification numbers. A small subset of patients also had their bank account number and/or limited health information such as diagnoses exposed.

LSU HCSD is reviewing its email security measures, which will be enhanced to prevent similar breaches in the future and additional security awareness training is being provided to employees.

PHI of 1,800 Patients Potentially Compromised in Lynn Community Health Center Phishing Attack

Lynn Community Health Center (LCHC) in Massachusetts discovered an employee’s email account was accessed by an unauthorized individual following a response to a phishing email. The phishing attack was discovered on November 25, 2020 and the email account was immediately secured. Assisted by a digital forensics company, LCHC determined that a maximum of 4 email accounts may have been compromised in the attack.

A review of the potentially breached accounts revealed they contained patient names in combination with one or more of the following data elements: Date of birth, mailing address, phone number, insurance information, medical record number, diagnoses, and other clinical information. A subset of patients also had their Social Security number exposed.

The investigation, which is ongoing, has not uncovered any evidence to suggest patient data was stolen or misused but as a precautionary measure, individuals whose Social Security number was potentially compromised have been offered complimentary credit monitoring and identity theft protection services.

Additional safeguards and security measures are being implemented to prevent further email security breaches, information protocols are being revised, and employee security awareness training has been reinforced.

1,440 Individuals Affected by Montgomery Hospice Phishing Attack

Montgomery Hospice, Inc. in Rockville, MD has learned that an unauthorized individual gained access to the email account of an employee on August 20, 2020. The breach was detected on November 16, 2020 and the email account was immediately secured.

A third-party cybersecurity firm was engaged to assist with the investigation, but it was not possible to determine which, if any, of the emails in the account were viewed or copied. A review of the email account confirmed the protected health information of 1,440 patients had been exposed, including names, medical record numbers, dates of birth, Social Security numbers, health insurance information, and limited medical information.

Affected individuals started to be notified about the breach on January 15, 2021. Only a limited number of patients had their Social Security numbers exposed and those individuals have been offered complimentary credit monitoring and identity protection services.

The hospice has since taken steps to improve email security and enhance its security infrastructure.  Further training has also been provided to the workforce on how to identify and avoid phishing emails.

Auris Health Notifies Patient About March 2020 Email Account Breach

Redwood City, CA-based Auris Health has started notifying certain patients that some of their protected health information has potentially been accessed by an unauthorized individual who gained access to the email account of an employee in March 2020.

Upon discovery of the breach, access to the account was terminated and an investigation was conducted to determine the nature and scope of the breach. The investigation into the attack is ongoing, but Auris Health has determined that the compromised email account included patient names in combination with one or more of the following data elements: Social Security Number, tax identification number, passport number, health insurance number, health information, payment card information, and financial account number(s).

Auris Health is implementing additional security measures to prevent further breaches in the future, including enhancing its email authentication measures. Affected individuals have been offered a 2-year complimentary membership to credit and identity theft monitoring services.

The post 5 Healthcare Providers Have Started Notifying Patients About Recent Phishing Attacks appeared first on HIPAA Journal.

Baptist Health’s Bethesda Hospital in Boynton Beach, FL has fired an employee for impermissibly accessing a patient’s protected health information and altering a home health order which was used to provide a patient with home care services.

The HIPAA breach was identified on December 1, 2020, prompting an internal investigation. The employee has now been terminated and the incident reported to law enforcement.

The investigation revealed other patient records may also have been accessed by the former employee between June 1, 2019 and December 2, 2020. The types of information potentially viewed included names, dates of birth, addresses, health insurance information, Social Security numbers, and clinical documentation.

All affected individuals have been notified and offered complimentary identity theft protection and credit monitoring services and Baptist Health is exploring ways to further safeguard patients’ protected health information and prevent similar breaches in the future.

The incident has yet to be listed on the HHS’ Office for Civil Rights’ website so it is currently unclear how many patients have been affected.

Montefiore Medical Center Fires Employee for Unauthorized Medical Record Access

Montefiore Medical Center in New York has discovered an employee accessed the protected health information of patients without authorization over a period of 5 months in 2020. Upon discovery of the unauthorized access, Montefiore immediately deactivated the employee’s access to the electronic medical record system and an investigation was launched to determine the extent of the HIPAA violations.

After a thorough investigation, the employee was terminated and the matter was reported to law enforcement for possible criminal prosecution. The types of information viewed by the former employee varied from patient to patient and may have included first and last names, addresses, dates of birth, medical record numbers, clinical information such as test results, diagnoses, and visit histories and the last four digits of Social Security numbers.

No reason was provided as to why the information was accessed, but no evidence was found to indicate patient information has been used for identity theft or fraud. All affected patients have now been notified and offered complimentary identity theft protection services.

This is the second incident involving improper medical record access to be announced by Montefiore Medical Center in the past 5 months. In September 2020, the medical center announced a former employee had stolen the PHI of approximately 4,000 patients between January 2018 and July 2020.

The post Montefiore Medical Center and Bethesda Hospital Fire Employees for HIPAA Breaches appeared first on HIPAA Journal.

The Tallahassee, FL-based Medicaid health plan, Florida Healthy Kids Corporation, has discovered its web hosting provider failed to patch vulnerabilities which were exploited by cybercriminals to gain access to its website and the protected health information of applicants for benefits for the past 7 years.

Florida Healthy Kids used Jelly Bean Communications Design, LLC. for hosting its website. The website included an online application that recorded information about individuals when they applied for Florida KidCare benefits or renewed their health or dental coverage online.

On December 9, 2020, Jelly Bean Communications notified Florida Healthy Kids that unauthorized individuals had gained access to the website and tampered with the addresses of several thousand applicants. Florida Healthy Kids engaged cybersecurity experts to conduct an investigation to determine the scope and severity of the breach.

Florida Healthy Kids temporarily shut down the website while the breach was investigated to prevent any further unauthorized access. The review of the hosted website platform and databases that supported the Florida KidCare application revealed several vulnerabilities were present from November 2013 to December 2020, and that the vulnerabilities had been exploited to gain access to the website.

While evidence was found showing applicant addresses had been tampered with, it is also possible that the attackers exfiltrated patient data, although evidence of data theft was not found.

The types of information exposed to the hackers included full names, birth dates, email addresses, telephone numbers, physical and mailing addresses, Social Security numbers, financial information, family relationships of individuals included in the application, and secondary insurance information.

The Florida KidCare online application remains offline while a new web hosting vendor is found. Affected individuals started to be notified on January 27, 2020 and have been advised to take steps to protect their identities, including setting up fraud alerts and security freezes. It is currently unclear exactly how many individuals have been affected.

The post Failure to Patch Results in 7-Year Breach of Florida Medicaid Applicants’ PHI appeared first on HIPAA Journal.

Roper St. Francis Healthcare has notified 189,761 patients that some of their protected health information was contained in employee email accounts that were accessed by an unauthorized individual. The email security breach was detected in late October 2020, and the subsequent investigation revealed three email accounts were compromised between October 14 and October 29, 2020.

A review off the email accounts was conducted to determine the information that was potentially accessed. It was not possible to tell if patient information was viewed or exfiltrated, although the attacker would have been able to access names, medical record numbers, patient account numbers, dates of birth, and limited treatment and clinical information, such as dates of service, locations of service, providers’ names, and billing information. The email accounts also contained the health insurance information and Social Security numbers of a limited number of patients.

Roper St. Francis Healthcare has offered complimentary credit monitoring and identity theft protection services to individuals whose Social Security number was potentially compromised. Steps have been taken to improve email security and employees have been provided with further training on email protection.

Einstein Healthcare Network Sends Additional Notifications About August 2020 Email Security Incident

Einstein Healthcare Network is notifying patients about a phishing attack that was discovered in the summer of 2020. The Pennsylvania-based healthcare provider, which operates medical centers in Philadelphia, Elkins Park, and East Norriton, identified unusual email account activity on August 10, 2020. The incident was investigated and it was determined that multiple employee email accounts had been accessed by an unauthorized individual between August 5, 2020 and August 17, 2020.

A review of the compromised email accounts was conducted to determine whether they contained any patient information. The review revealed emails and attachments contained the following types of patient data: Names, dates of birth, medical record numbers, patient account numbers, diagnoses, medications, provider names, types of treatment, and treatment locations. The types of information in the accounts varied from patient to patient, which for some patients also included Social Security numbers and health insurance information.

It was not possible to determine whether the unauthorized individual viewed or exfiltrated patient data while access to the email accounts was possible. Einstein Healthcare Network sent out a batch of breach notification letters to individuals potentially affected by the incident starting on October 9,2020. The breach was reported to the HHS’ Office for Civil Rights the same day. The OCR breach portal lists the incident as affecting 1,821 patients.

According to Einstein Healthcare Network’s substitute breach notice, “We continued our investigation, which concluded on November 16, 2020, and additional letters are mailing between January 21, 2021 and February 8, 2021.”

Email Incident Report by New York Center for Alternative Sentencing and Employment Services

The Center for Alternative Sentencing and Employment Services (CASES) in New York has discovered the email accounts of certain employees have been compromised. Hackers had access to the email accounts between July 6 and October 4, 2020.

An investigation of the breach revealed the hackers exfiltrated emails from the accounts that included patient data. For most patients, the stolen information was limited to name, date of birth, medical record/client ID number, and some clinical information related to the care provided by CASES. Some clients also had their Social Security number, driver’s license number, and/or health insurance information stolen. Those individuals have been offered complimentary credit monitoring and identity theft protection services.

Steps have since been taken to improve email security and the workforce has received further security awareness training.

The post Almost 190,000 Patients Affected by Roper St. Francis Healthcare Phishing Attack appeared first on HIPAA Journal.

Gainwell Technologies has discovered unauthorized individuals have potentially accessed the information of certain participants of Wisconsin’s Medicaid program, which was stored in emails and email attachments in a compromised account.

Access to the email account was first gained on October 29, 2020 and continued until November 16, 2020. The account contained information such as names, member ID numbers, and billing codes for services. Approximately 1,200 Wisconsin Medicaid members have been affected. Affected individuals have been offered a 1-year complimentary membership to credit monitoring services.

Gainwell provides fiscal-agent services for the Wisconsin Department of Health Services (DHS) Medicaid Program. Since the breach occurred, the DHS and Gainwell have worked together to prevent similar breaches in the future.

This is the second incident to be reported as having affected Gainwell in recent weeks. Gainwell operates the Medicaid Management Information System used by the Tennessee state Medicaid health plan, TennCare. Gainwell discovered an error at a mailing vendor resulted in mailings being sent to incorrect addresses between 2019 and 2020. The two incidents are not related.

Email Account Breach Reported by Mattapan Community Health Center

Mattapan Community Health Center (MCHC) is notifying 4,075 patients that some of their protected health information was contained in an email account that was accessed by unauthorized individuals.

Unusual email account activity was detected on October 16, 2020. Assisted by a third-party computer forensics firm, MCHC determined the email account was compromised on July 28, 2020. Through a manual and programmatic review of the email account, MCHC determined the following information may have been accessed by unauthorized individuals: Names, Social Security numbers, medical diagnoses, treatment information, provider information, health insurance information, and/or medical record numbers.

Additional security measures have now been implemented to prevent further email security breaches.

Conti Ransomware Gang Leaks Data Stolen in Attack on TaylorMade Diagnostics

Chesapeake, VA-based TaylorMade Diagnostics, an operator of occupational health clinics used by transportation companies and government agencies, has suffered a ransomware attack that has resulted in workers’ health data being leaked online.

Approximately 3,000 files stolen by the ransomware gang prior to file encryption have been published on a darknet leak site operated by the Conti ransomware gang. The leaked data relates to employees of Taylor Made Diagnostics clients, including the United Parcel Service and Norfolk Southern Railroad. The leaked data includes details of medical examinations, drug and alcohol testing reports, and full names, Social Security numbers, and scans of driver’s licenses.

Hendrick Health Provides Update on November 2020 Ransomware Attack

Hendrick Health has provided further information on a ransomware attack that forced it to adopt EHR downtime procedures in November 2020. The attack was detected on November 20, 2020 and steps were immediately taken to contain the attack. The investigation into the incident has revealed the attackers first gained access to its systems on October 10, 2020 and potentially viewed or obtained patient information between that date and November 9, 2020.

The types of data that may have been accessed included patients’ names, Social Security numbers, demographic data, and other information related to the care provided by Hendrick Health. The incident only affected patients who had previously received medical services at Hendrick Medical Center or the Hendrick Clinic. The locations at Hendrick Medical Center Brownwood and Hendrick Medical Center South were not affected.

The ePHI of 640,436 patients was stored on the compromised systems. Data security measures and system monitoring have now been strengthened and new features have now been added to its security alert software.

The post Data Breaches Reported by Gainwell Technologies, TaylorMade Diagnostics, and Mattapan Community Health Center appeared first on HIPAA Journal.