Hospital Sisters Health System has recently discovered an email security breach in August 2019 potentially resulted in unauthorized individuals gaining access to access emails and email attachments containing the protected health information of 16,167 patients.

Hospital Sisters Health System is a 15-hospital health system serving patients in Illinois and Wisconsin. Between August 6, 2019 and August 9, 2019, unauthorized individuals gained access to the email accounts of several employees. Prompt action was taken to secure the affected email accounts by changing passwords and a leading computer forensic firm was retained to investigate the breach and determine whether the compromised accounts contained patient information.

On December 2, 2019, Hospital Sisters Health System was informed that patient information had potentially been accessed by the attackers. The compromised email accounts were found to contain patient names, birth dates, and a limited amount of clinical information. Some patients also had their health insurance information, Social Security number, and/or driver’s license number exposed.

On January 31, 2020, Hospital Sisters Health System started mailing notification letters to all affected patients. Individuals whose Social Security number or driver’s license number was exposed have been offered complimentary membership to identity theft protection services and all individuals have been advised to monitor their accounts and explanation of benefits statements closely and to report any suspicious activity to law enforcement.

Hospital Sisters Health System has already taken steps to improve email security to prevent similar breaches from occurring in the future.

The post Hospital Sisters Health System Email Breach Impacts 16,167 Patients appeared first on HIPAA Journal.

Portland, OR-based Sunshine Behavioral Health Group, a provider of business services to healthcare providers, has discovered a cloud-based system used to store patient health records was accidentally misconfigured. The misconfiguration allowed patient information to be accessed over the internet.

The error was identified on September 4, 2019 and access controls were immediately implemented to prevent the records from being accessed by unauthorized individuals. Further actions were taken on November 14, 2019 to remove the records from general internet access.

On December 23, 2019, Sunshine Behavioral Health Group determined a folder in the cloud-based system contained information such as names, addresses, credit/debit card numbers, expiry dates, security codes, and electronic/digital signatures of individuals who had paid for healthcare services.

The exposed data related to payors for medical services received at Monarch Shores, Chapters Capistrano, Willow Springs Recovery, and Mountain Springs addition treatment and rehabilitation centers.

All individuals whose information was exposed have been offered complimentary membership to MyIDCare protection services for 24 months.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal so it is currently unclear how many individuals have been affected.

Thieves Stole Patient Information in Lake County Behavioral Health Burglary

Lake County Behavioral Health in Clearlake, CA, has announced it experienced a burglary on December 5, 2019 and thieves stole a locked filing cabinet containing client health information.

The stolen paperwork contained information such as patient names, contact telephone numbers, case numbers, medications, appointment dates and times, payments, and amounts due. One file contained a patient’s date of birth, Social Security number, medical history, disability status, substance use history, income verification information, and Medi-Cal ID number.

All patients whose information was stolen have been notified by mail and advised to register a fraud alert in case their information is misused. All remaining files have been relocated to a locked room in the heart of the facility, an alarm system has been fitted along with video surveillance with 24-hour monitoring. The break-in is being investigated by the Clearlake Police Department but no arrests have been made.

Jefferson Center for Mental Health Announces Potential Breach of PHI

Jefferson Center for Mental Health, a nonprofit provider of community-focused mental health care and substance use services in Colorado, experienced a burglary at its Independence Corner facility in Wheat Ridge on November 29, 2019.

The burglary was discovered on December 2, 2019 and the break-in was reported to law enforcement. No paperwork containing patient information was taken by the perpetrators, but it is possible that the personal and treatment information of 1,319 patients was viewed by the thieves.

Unauthorized data access is not suspected, but patients have been advised to monitor their accounts as a precaution. Jefferson Center for Mental Health is now taking steps to improve physical security at its offices.

The post Sunshine Behavioral Health Group Discovers PHI Exposed Over Internet appeared first on HIPAA Journal.

Oregon’s Medicaid coordinated-care organization, Health Share of Oregon, is notifying approximately 654,000 current and former members that some of their protected health information (PHI) was stored on a laptop computer stolen from its transportation vendor, GridWorks.

GridWorks was contracted to manage Health Share’s Ride to Care program, through which Health Share provided non-emergent transportation for its members.

Health Share’s policies require business associates to use encryption on all portable devices containing patient information but, for reasons unknown, the GridWorks laptop was not encrypted. PHI stored on the laptop computer included names, addresses, contact telephone numbers, birth dates, Health Share ID numbers, Medicaid numbers, and Social Security numbers.

The laptop was stolen in a burglary at GridWorks’ office in November 2019. GridWorks notified Health Share about the laptop theft on January 2, 2020. Health Share started sending notification letters on February 5 to all individuals whose PHI was stored on the laptop. Affected individuals have been offered one year of complimentary credit monitoring and identity theft protection services.

Health Share conducts security audits of its vendors and last audited GridWorks in March 2019. In response to the breach, Health Share will expand its vendor security audit program and steps have been taken to ensure only the minimum amount of patient information is transmitted to its vendors. Training policies have also been enhanced.

In October 2019, Health Share announced that the nonprofit health plan, CareOregon, would be taking over the administration of its Ride to Care program. GridWorks had failed to pay several transportation companies that provided transport under the Ride to Care program. The company went into receivership in December 2019 and will cease operations once the administration of the Ride to Care program has been fully transferred to CareOregon.

The post Health Share of Oregon Notifies 654,000 Members About Business Associate Data Breach appeared first on HIPAA Journal.

Village Center for Care dba VillageCare Rehabilitative and Nursing Center (VRNC) and Village Senior Services Corporation dba VillageCareMAX (VCMAX) have fallen victim to a business email compromise (BEC) attack. BEC attacks involve the impersonation of an executive, either using the executive’s genuine email account compromised in a previous attack or by spoofing the executive’s email address.

An unauthorized individual, pretending to be member of the executive team, requested sensitive information on VRNC patients and VCMAX members. Believing the request to be legitimate, the employee responded and provided the information as requested. VCMAX and VRNC were alerted to a potential BEC attack on or around December 30, 2019.

The investigation confirmed the request was not genuine and sensitive information on VRNC patients and VCMAX members had been impermissibly disclosed. The information sent via email included the names and Medicaid ID numbers of 2,645 VCMAX members and first and last names, dates of birth, insurance provider names, and Insurance ID numbers of 674 VRNC patients.

There have been no reports of misuse of personal information, but all affected individuals have been advised to be vigilant and check accounts, credit reports, and explanation of benefits statements for signs of fraudulent activity. VCMAX and VRNC are reviewing and enhancing their policies and procedures to prevent further attacks of this nature in the future.

1,860 Individuals Impacted by Phishing Attack on Phoenix Children’s Hospital

The email accounts of seven employees of Phoenix Children’s Hospital have been compromised as a result of a targeted phishing campaign between September 5 and September 20, 2019.

Upon discovery of the breach, a leading computer forensic firm was engaged to investigate the extent of the breach. The hospital learned on November 15, 2019 that the compromised accounts contained the protected health information of 1,860 current and former patients which may have been viewed or obtained by the attackers.

The accounts were found to contain patient names, personal information and, for some individuals, limited health information and Social Security numbers.

On January 14, 2020, Phoenix Children’s Hospital started notifying affected patients by mail. Complimentary credit monitoring and identity theft protection services have been offered to patients whose Social Security number was potentially compromised.

The post New York Nursing Center and Phoenix Children’s Hospital Affected by Phishing Attacks appeared first on HIPAA Journal.

On November 21, 2019, Fondren Orthopedic Group, an association of private orthopedic surgery practitioners in Houston and the surrounding areas, experienced a cyberattack that affected certain parts of its IT system.

In a substitute breach notice posted on its website, the incident was described as a malware attack that damaged the medical records of certain patients. Prompt action was taken to contain the infection and its systems were restored; however, the medical records corrupted by the malware could not be recovered and have been permanently lost.

The corrupted records included patients’ names, addresses, telephone numbers, health insurance information, and diagnosis and treatment information. All patients affected by the incident were current or former patients of Dr. K. Matthew Warnock.

Third party forensic investigators were engaged to assist with the investigation and found no evidence of unauthorized data access or exfiltration of data. Fondren Orthopedic Group is reviewing data security policies and procedures and will be enhancing its security protocols to improve resilience to malware attacks. Affected patients have been notified and informed that they will need to complete new patient forms and supply details of their medical histories when they next visit Dr. Warnock.

The cyberattack has been reported to the HHS’ Office for Civil Rights. The breach summary shows up to 30,049 patients have been affected.

Access Health CT Notifies 1,100 About Unspecified Data Breach

Access Health CT, the health insurance marketplace in Connecticut, has notified approximately 1,100 consumers that some of their protected health information was exposed in a data breach.

In its substitute breach notice, Access Health CT apologized for any inconvenience caused by the breach and said affected individuals have been offered free access to services to help them protect their personal information. The breach notice did not explain the nature of the breach, when it occurred, nor the types of information that were compromised.

The notice states, “Several efforts to improve security are already in place, with longer-term initiatives planned regarding system changes and more frequent Information Technology (IT) security training to improve data protection and security awareness.”

The post Malware Attack Results in Corruption of Medical Records: 30,000 Patients Affected appeared first on HIPAA Journal.

Manchester Ophthalmology in Connecticut has experienced a cyberattack in which the attackers may have gained access to patient information.  The eye care provider became aware of the cyberattack on November 25, 2019 when employees noticed unusual activity on the network. Assisted by a third-party technology firm, it was determined later that day that hackers had gained access to its systems and attempted to deploy ransomware. Access was first gained to the network on November 22, 2019 and continued until November 25. Remote access was rapidly terminated before information was encrypted.

The investigation found no evidence to suggest any patient information was accessed or downloaded by the attackers, but during the investigation it was determined that certain patient information had not been backed up and could not be recovered. The types of data lost included names, patient-created medical histories, and details of the care those patients received at Manchester Ophthalmology.

Patients have been advised to exercise caution and monitor their accounts and explanation of benefits statements for any sign of fraudulent use of their information. Manchester Ophthalmology has provided further training to employees to ensure the proper backup of all information.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 6,846 patients were affected by the security breach.

UnitedHealthcare Alerts Patients About 2019 Data Breach

On January 31, 2020, the Minnetonka, MN health insurer, UnitedHealthcare, announced it was the victim of a data breach in 2019 in which the private information of some of its customers in South Carolina was potentially compromised.

UnitedHealthcare was notified about the data breach on December 10, 2019 and determined that at some point between July 30, 2019 and Nov 13, 2019 an unauthorized individual gained access to the health information of certain members through its member portal. Only members’ first and last names, health plan information, and medical claims data was compromised.

UnitedHealthcare said it is assisting with the law enforcement investigation and steps have been taken to prevent further breaches of this nature in the future. The HHS’ Office for Civil Rights Breach portal indicates 934 individuals were affected by the breach.

2,713 Individuals Informed of Cook County Health Mailing Error

Chicago, IL-based Cook County Health has started notifying 2,713 individuals that some of their protected health information was sent to a third-party vendor in error. The information related to individuals participating in a #keepingitLITE study and was sent to a vendor who was due to assist with mailing study information.

The list of study participants, which was limited to names, addresses, and email addresses, was sent before a business associate agreement was in place. A business associate agreement confirms that a vendor agrees to implement safeguards to ensure the privacy and security of any information. Without the BAA, satisfactory assurances that those safeguards were in place had not been received by Cook County Health.

Action has now been taken to ensure similar errors are prevented in the future.

The post Data Breaches Reported by Manchester Ophthalmology, UnitedHealthcare, and Cook County Health appeared first on HIPAA Journal.

Researchers at TechCrunch have identified a security flaw in a website hosting an internal customer relationship management system used by the clinical laboratory network LabCorp. While the system was password protected, the researchers found a flaw in the part of the system that pulled patient files from the back-end system. The flaw allowed patient data to be accessed without requiring a password and the web address was visible to search engines.

Google had cached only one document containing the health data of a patient, but by changing the document number in the web address the researchers were able to open other documents containing patient health information.

The researchers examined a small selection of files to see what types of data had been exposed. The documents mostly contained information about patients who had tests conducted by LabCorp’s Integrated Oncology specialty testing unit. The documents contained personal information such as names and dates of birth, lab test results and diagnostic data, and for some patients, Social Security numbers.

TechCrunch researchers used computer commands to determine the number of documents accessible on the website. They structured the commands to return information about the properties of the files, rather than opening the documents, to avoid accessing patient information. The analysis revealed around 10,000 documents could potentially be accessed.

TechCrunch notified LabCorp about the issue and the server was taken offline while the flaw was corrected. The link to the exposed data has not yet been removed from Google, but it is no longer active and cannot be used to view patient data.

The is the second major security incident to be experienced by LabCorp in the past 12 months. The records of LabCorp patients were exposed in the 26 million-record breach at American Medical Collection Agency (AMCA) in March 2019. 7.7 million LabCorp patients were initially thought to have been affected, but the breach was reported to the HHS’ Office for Civil Rights as having affected up to 10,251,7847 LabCorp patients.

The post Website Error Exposed Personal and Health Data of LabCorp Patients appeared first on HIPAA Journal.