Several healthcare providers have been affected by an unusual data breach at Waupaca, WI-based STAT Informatics Solutions, LLC. STAT provides secure medical records services to several healthcare providers which includes scanning paper files so they can be added to hospital medical record systems.

On March 3, 2020, a STAT facility in Lebanon, TN was hit by a tornado, which caused extensive damage to the building and some of the records stored in the facility. STAT notified all affected clients the same day, and representatives of those healthcare providers visited the site to assist with locating and securing medical records in the facility.

To limit the potential for unauthorized access, a tall fence was erected around the building while the medical records were located and secured. Two security guards were also posted on site 24/7 to prevent unauthorized individuals from accessing the building.

The majority of the medical records were found in the remnants of the building, but the records were determined to be unsalvageable and have now been securely destroyed.

While it is possible that unauthorized individuals may have viewed some paperwork relating to patients, no evidence has been uncovered to suggest that was the case and patients are not believed to be at risk of financial harm. Out of an abundance of caution, patients whose records were stored in the building are being notified by mail and will be offered complimentary credit monitoring services.

The medical records at the facility contained the following types of information: Full names, Social Security numbers, addresses, dates of birth, medical record numbers, account numbers, medical images, diagnoses, nursing and physician documentation, test results, medications, and other types of information typically found in medical records.

The following healthcare providers have confirmed they were affected by the incident.

• Bayfront Health Port Charlotte, FL
• Bayfront Health Punta Gorda, FL
• Commonwealth Health Wilkes-Barre General Hospital, PA (518 records)
• Commonwealth Health Moses Taylor Hospital, PA (1,905 records)
• Poplar Bluff Regional Medical Center, MO (1,619 records)

The post Patients Notified Medical Records Exposed at Tornado Hit Secure Medical Record Facility appeared first on HIPAA Journal.

BJC Healthcare has announced that the email accounts of three of its employees have been accessed by an unauthorized individual after the employees responded to phishing emails.

Suspicious activity was detected in the email accounts on March 6, 2020 and the accounts were immediately secured. A leading computer forensics firm was engaged to conduct an investigation which revealed the three accounts had only been accessed for a limited period of time on March 6. It was not possible to tell if patient data was viewed or obtained by the attacker.

A review of the accounts revealed they contained the data of patients at 19 BJC and affiliated hospitals. Protected health information in emails and attachments varied from patient to patient and may have included the following data elements:

Patients’ names, medical record numbers, patient account numbers, dates of birth, and limited treatment and/or clinical information, which included provider names, visit dates, medications, diagnoses, and testing information. The health insurance information, Social Security numbers, and driver’s license numbers of certain patients were also potentially compromised.

All patients affected by the breach will be notified by mail when the email account review is completed. Patients whose driver’s license or Social Security number has potentially been compromised will be offered complimentary credit monitoring and identity theft protection services.

BJC HealthCare said additional security measures will be implemented to prevent incidents such as this in the future and staff will be retrained to help them identify and avoid suspicious emails.

The following BJC HealthCare and affiliated hospitals were affected by the breach:

• Alton Memorial Hospital
• Barnes-Jewish Hospital
• Barnes-Jewish St. Peters Hospital
• Barnes-Jewish West County Hospital
• BJC Behavioral Health
• BJC Corporate Health Services
• BJC Home Care
• BJC Medical Group
• Boone Hospital Center
• Christian Hospital
• Memorial Hospital Belleville
• Memorial Hospital East
• Missouri Baptist Medical Center
• Missouri Baptist Physician Services, LLC
• Missouri Baptist Sullivan Hospital
• Parkland Health Center Boone Terre
• Parkland Health Center Farmington
• Progress West Hospital
• Louis Children’s Hospital

The post Phishing Attack at BJC HealthCare Impacts Patients at 19 Hospitals appeared first on HIPAA Journal.

Ambry Genetics, an Aliso Viejo, CA-based genetic testing laboratory, is notifying 232,772 individuals that some of their protected health information was exposed as a result of a recent email security breach. At almost 233,000 records, this is the second largest healthcare data breach to be reported in 2020.

Ambry Genetics discovered an unauthorized individual gained access to an employee’s email account between January 22 and January 24, 2020 and potentially viewed and obtained the protected health information of its customers. The security team and third-party computer forensics experts were unable to determine if any information in the compromised accounts was accessed or stolen, but no reports have been received to suggest any personal information has been misused.

The email accounts were reviewed and found to contain information such as names, medical information, and other information related to the services provided by Ambry Genetics. A small number of individuals also had their Social Security number exposed.

Ambry Genetics has taken steps to enhance security and further training on email security is being provided to its employees.

Former Arizona Endocrinology Center Physician Takes PHI of 74,000 Patients to New Employer

Arizona Endocrinology Center is alerting 74,122 patients that some of their protected health information has been impermissibly disclosed to another medical group by a physician after he left the practice.

Before Dr. Dwivedi left Arizona Endocrinology Center, he downloaded patient data and disclosed the information to his new employer, More MD. Patient names, telephone numbers, addresses, medical record numbers, and the names of patients’ primary doctor were downloaded from the EHR. No Social Security numbers, health insurance information, or financial data was obtained by Dr. Dwivedi.

Arizona Endocrinology Center learned of the incident on February 17, 2020 when patients started reporting they had received text messages from More MD advising them that Dr. Dwivedi had moved to the medical group. More MD also advertised its services in the text messages. The breach investigation revealed the data was downloaded on January 12, 2020.

Arizona Endocrinology Center has told its patients that it has no business relationship with More MD and Dr. Dwivedi no longer works for the practice, so it has been difficult to obtain solid assurances that patient data has now been deleted and will not be used. The practice explained on its website that “our patients and their families are free to contact Dr. Dwivedi and More MD directly to ask them about their personal information.”

The post 233,000 Patients Notified About PHI Breach at Genetic Testing Lab appeared first on HIPAA Journal.

Michigan’s largest healthcare system, Beaumont Health, has announced that unauthorized individuals have gained access to the email accounts of some of its employees and potentially viewed or obtained patient information stored in emails and email attachments.

On March 29, 2020, Beaumont Health learned that the email account breach, which occurred almost 10 months ago, resulted in the exposure and potential theft of patient information. The investigation of the breach revealed the email accounts were accessed by unauthorized individuals between May 23, 2019 and June 3, 2019. A forensic investigation was performed to determine the extent and scope of the breach, along with a manual review of all emails in the compromised accounts. That review has taken some time to complete, hence the delay in issuing breach notification letters.

The breached email accounts were discovered to contain the protected health information of around 5% of its 2.3 million patients, which is around 112,000 individuals. The types of information exposed and potentially stolen varied from patient to patient and may have included names in combination with one or more of the following data elements: Dates of birth, diagnoses, diagnosis codes, treatment locations, treatment types, procedures, prescription information, internal patient account numbers and medical record numbers. A “limited” number of Social Security numbers and other data was also potentially compromised. While email account access was confirmed, it was not possible to tell if the attackers accessed or stole patient information.

The breach has prompted Beaumont Health to provide further training to the workforce to help employees recognize phishing and other malicious emails. Internal procedures have also been revised and additional technical safeguards have been implemented to prevent further breaches in the future.

This is the second data breach to be announced by Beaumont Health this year. In January, the health system notified 1,182 patients that a former employee had been accessing the records of patients who had received treatment after an automobile accident. The former employee is understood to have disclosed the data to a personal injury lawyer.

The post Beaumont Health Notifies 112,000 Patients About May 2019 Data Breach appeared first on HIPAA Journal.

Washington University School of Medicine is notifying 14,795 oncology patients that some of their protected health information was stored in an email account that was breached in January 2020.

An unauthorized individual gained access to the email account of a research supervisor in the Division of Oncology between January 12, 2020 and January 13, 2020 as a result of a response to a phishing email. Upon discovery of the breach, immediate action was taken to secure the account and prevent further unauthorized access and a third-party computer forensics firm was engaged to assist with the investigation.

A painstaking review of emails and email attachments in the account revealed they contained the following patient information: Names, dates of birth, medical record numbers, patient account numbers, limited treatment and/or clinical information, including diagnoses, provider names, and lab test results. Certain patients also had their health insurance information and/or Social Security numbers exposed.

Affected individuals are now being notified about the breach and individuals whose Social Security numbers were potentially compromised have been offered complimentary membership to credit monitoring and identity protection services.

Washington University School of Medicine has taken steps to improve email security and has reinforced education with its employees to help them identify suspicious emails.

Phishing Attack Reported by Doctors Community Medical Center

Doctors Community Medical Center in Maryland is alerting certain patients to a breach of their protected health information.

The data breach was identified in January 2020 when suspicious activity was detected in its payroll system. An investigation into the breach revealed a small number of employees had been duped by phishing emails and had disclosed their account credentials to the attackers. In addition to gaining access to the employees’ email accounts, the attackers also had access to the employees’ payroll information.

The investigation confirmed that the first accounts were breached on November 6, 2019, with access possible until January 30, 2020. Around February 13, 2020, Doctors Community Medical Center determined that some of the compromised email accounts contained data sheets that included patient information.

A forensic investigation conducted by third-party investigators was unable to confirm if patient data had been accessed, copied, or disclosed, although no reports have been received to suggest patient information has been misused. Since unauthorized data access could not be ruled out, patients have been notified and offered complimentary credit monitoring and identity restoration services.

The types of information that were potentially compromised included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, military identification numbers, financial account information, diagnoses, treatment information, prescription information, provider names, medical record numbers, patient IDs, Medicare/Medicaid numbers, health insurance information, treatment cost information, and access credentials.

The health system is reviewing and updating its policies and procedures and additional safeguards will be implemented to prevent further attacks.

The post Washington University School of Medicine Breach Impacts 14,795 Oncology Patients appeared first on HIPAA Journal.