Loudoun Medical Group, dba Comprehensive Sleep Care Center (CSCC), has been affected by a phishing attack that occurred on or around June 19, 2019.

The IT department was alerted to a potential email security breach when suspicious activity was detected in an employee’s email account. The password was immediately changed to prevent further unauthorized access and the incident was investigated.

Forensic investigators confirmed the breach was confined to a single email account that was accessed by an unauthorized individual between June 15, 2019 and June 19, 2019.

On October 17, 2019, the investigators confirmed which patient information had been accessed. The information in the email account varied for each patient and may have included the patient’s name along with one or more of the following data elements: Date of birth, Social Security number, passport number, driver’s license number, medical record number, payment card information, patient account number, financial account information, medical history, health insurance information, treatment information and/or date(s) of service.

Additional safeguards have now been implemented to prevent further email security breaches and affected individuals have been provided with information on how they can minimize risk of PHI misuse. To date, no evidence of attempted or actual misuse of patient information has been found.

McLaren Health Plan Affected by Phishing attack on Business Associate

McLaren Health Plan in Flint, MI has discovered the protected health information of some of its members may have been accessed by unauthorized individuals as a result of a phishing attack on one of its business associates, Magellan Rx Management. Magellan Rx Management provided services to the health plan up until December 31, 2018.

Magellan Health announced on November 27, 2019 that its subsidiary, Magellan Rx Management, experienced a phishing attack on May 28, 2019. Magellan Rx discovered the attack on July 5, 2019 and launched a thorough investigation to determine the extent of the breach. The investigation confirmed the breach was limited to a single email account, and that the email account contained the protected health information of certain McLaren Health Plan members such as names, birth dates, health plan member ID numbers, health plan name, provider, diagnosis, drug, and authorization information. McLaren Health plan was informed of the breach on October 4, 2019.

The aim of the attack appears to have been solely to use the email account to send spam. No evidence of data access or misuse has been uncovered.  Magellan Health has since enhanced email security and is providing further training to employees to help them detect malicious emails in the future.

Email Security Breach at Ivy Rehab Physical Therapy

Ivy Rehab Physical Therapy, a network of 200 physical therapy clinics, has experienced a phishing attack in which the protected health information of patients was potentially compromised.

The company discovered the attack in May 2019 and launched an investigation. On September 26, 2019, third-party forensic investigators determined that the protected health information of certain patients was stored in the compromised accounts and may have been accessed by the attackers. No reports of misuse of patient information have been received and no actual evidence of unauthorized data access was identified.

The information potentially accessed included names along with one or more of the following data elements: Health information, Social Security numbers, and financial information. Affected individuals have been offered complimentary identity theft restoration and credit monitoring services.

In response to the attack, Ivy Rehab has changed its password policies and requires more frequent password changes and further, ongoing security awareness training is being provided to staff members.

The post Phishing Attacks Announced by Comprehensive Sleep Care Center, McLaren Health Plan, and Ivy Rehab Physical Therapy appeared first on HIPAA Journal.

North Platte, NE-based Great Plains Health has experienced a ransomware attack that has resulted in the encryption of patient medical records.

The attack was detected at around 7pm on Tuesday, November 26. Prompt action was taken to minimize the impact on patients, and staff switched to pen and paper while computer systems were offline. IT staff have been working round the clock dealing with the attack.

With access to medical records prevented, the decision was taken to cancel non-emergency patient appointments and some medical procedures, although surgeries and certain imaging procedures are continuing to be provided as normal. The hospital has not switched to emergency operations and is not diverting patients.

The attack also impacted its phone and email system, although voicemail is unaffected. Staff have been checking voicemail messages regularly and have been calling patients back who have not been able to get through on the telephone.

It is currently unclear whether the ransom demand was paid or if medical records and other encrypted files are being restored from backups. Officials are currently unsure how long it will take to recover from the attack but suggest it could take weeks or even longer.

While patient information was encrypted, Great Plains Health does not believe that any patient information has been viewed or stolen by the attackers. The sole purpose of the attack appears to have been to extort money from Great Plains Health. A full audit of its systems will be conducted to determine whether patient information has been accessed or stolen.

Atria Senior Living Experiences Phishing Attack

The Louisville, Kentucky-based retirement and assisted living company, Atria Senior Living, has announced that an unauthorized individual has gained access to the email accounts of some of its employees and potentially accessed the protected health information of certain clients.

Assisted by a cybersecurity firm, Atria Senior living determined that several employee email accounts had been compromised and were accessed by an unauthorized individual on various occasions between September 18 and September 20, 2019.

A review of all affected email accounts was conducted to determine the types of information that had potentially been compromised and which clients had been affected. It was not possible to tell whether emails or attachments had been opened or copied.

Since unauthorized data access could not be ruled out, affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.

Atria Senior Living has now implemented additional security measures and safeguards to prevent further email security breaches. It is currently unclear how many individuals have been affected by the email security breach.

The post Great Plains Health Ransomware Attack Prevents Access to Patient Medical Records appeared first on HIPAA Journal.

Children’s Minnesota has started notifying 37,942 patients that information related to their appointments has been exposed and could have been accessed by unauthorized individuals.

The internal, electronic calendars used by certain staff members had been configured in a way that allowed them to be viewed by individuals outside of Children’s Minnesota’s system. The misconfiguration was detected on August 26, 2019 and was immediately corrected to prevent unauthorized access.

A third-party computer forensics company was engaged to assist with the investigation and determine the extent of the privacy breach. The firm confirmed that in some cases, the calendars may have been misconfigured for several years, with the earliest case determined to be December 2011.

The calendars contained a limited amount of patient information, such as patient names, medical record numbers, dates of birth, insurance information, account numbers, appointment times and locations, names of procedures, and healthcare provider names.

It was not possible to determine whether the calendars had been accessed by unauthorized individuals during the time they were accessible. Affected individuals have been advised to monitor their account statements and explanation of benefits statements for any sign of fraudulent use of their information.

Children’s Minnesota will be reviewing its security policies and will provide additional training to staff to prevent similar incidents of this nature from occurring in the future.

PHI of 15,975 Individuals Exposed Due to Central Valley Regional Center Phishing Attack

Central Valley Regional Center (CVRC), a Merced, CA-based provider of health and support services to individuals with intellectual and developmental disabilities, has discovered an unauthorized individual has gained access to the email accounts of certain employees and potentially viewed or obtained sensitive client information.

The email security breach was discovered on July 29, 2019. The affected email account was immediately disabled, and an investigation was launched to determine the extent of the breach. Assisted by a third-party computer forensics firm, CVRC determined that multiple email accounts had been compromised between July 25 and August 2, 2019. Those email accounts contained information on 15,975 clients.

No evidence of data access or PHI theft was discovered, and no reports have been received to indicate any client information has been misused. However, it was also not possible to rule out unauthorized data access or data exfiltration. As a precaution, affected individuals have been notified and offered complimentary credit monitoring and identity theft protection services.

The types of information that may have been viewed varied from individual to individual and could have involved the following data elements:  Names, addresses, telephone numbers, dates of birth, death dates, Social Security numbers, driver’s license information, state ID card numbers, other government ID numbers, Medi-Cal numbers, UCI numbers, health insurance information, and medical and health information.

A limited number of individuals also had their taxpayer ID number, financial account/payment card information, PINs/ access codes, account password, username, email address, or electronic identifier (and the means to access the related accounts), and/or IRS PIN exposed.

Steps have now been taken to improve security and prevent similar breaches from occurring in the future.

The post Misconfigured Staff Calendars Exposed Information of Children’s Minnesota Patients for Up to 9.5 Years appeared first on HIPAA Journal.

Saint Francis Healthcare System has announced that the computer network of Ferguson Medical Group has been attacked with ransomware.

The attack occurred on September 21, 2019, before Saint Francis Medical Center acquired the Sikeston, MO-based medical group. Saint Francis Healthcare learned about the ransomware attack on September 21.

According to a notice on the Saint Francis Healthcare website, the attackers succeeded in encrypting medical records of all patients who had received medical services at Ferguson Medical Group prior to January 1, 2019. The incident was reported to the Federal Bureau of Investigation and steps were immediately taken to isolate the affected systems.

The attackers demanded payment of a ransom for the keys to decrypt files on the network. Since there was no guarantee that the attackers were able to supply working decryption keys and due to other uncertainties, the decision was taken not to pay and to instead recover files from backups.

While many files were recovered, some information could not be restored and has been permanently lost. It was not possible to recover any documentation that had been scanned and saved on its systems, and medical records for patients who received services at Ferguson Medical Group between September 20, 2018 and December 31, 2018 were also permanently lost.

An analysis of the attack uncovered no evidence to suggest the attackers obtained files containing the protected health information of patients prior to encryption and there have been no reports received to suggest any patent information has been misused. However, since it is not possible to rule out unauthorized data access and theft, affected patients have been offered complimentary credit monitoring and identity theft protection services.

The incident has been listed on the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach summary indicates 107,054 Ferguson Medical Group patients have been affected. It is not clear how many of those patients have had some or all of their health information lost as a result of the attack.

The post 107,000 Ferguson Medical Group Patients Impacted by Ransomware Attack appeared first on HIPAA Journal.

The Florida physician network, Aegis Medical Group, has started notifying 9,800 patients that their protected health information may have been accessed by a former employee. That individual is understood to have attempted to sell patient records to third parties suspected of being involved in identity theft and fraud.

Aegis Medical Group was informed by law enforcement on September 11, 2019 about the employee. The law enforcement investigation determined that the employee attempted to sell the data of just two patients. Working with law enforcement, the physician network determined that the records of up to 9,800 patients were potentially accessed by the employee between July 24, 2019 and September 9, 2019.

The information contained in the records was limited to first and last names, dates of birth, account numbers, postal addresses, diagnosis information, and Social Security numbers. Approximately 75% of the records that may have been accessed were physical records rather than electronic copies.

Following notification by law enforcement, Aegis Medical Group immediately terminated the employee. It is unclear at this point in time whether the former employee has been charged.

Due to the nature of data exposed, all affected patients have been advised to monitor their accounts, explanation of benefits statements, and credit card statements for signs of misuse of their information and have been told about other steps they can take to prevent identity theft and fraud. Complimentary credit monitoring and identity theft protection services are also being provided.

Aegis Medical Group has confirmed that all physical records were stored properly although, to improve security, physical records are now being converted to digital formats as digital records are easier to secure and monitor for unauthorized access. Employees have been notified about the incident, told about the consequences of improper PHI access, and the importance of maintaining the confidentiality and security of patient records.

The post Former Aegis Medical Group Employee Potentially Accessed 9,800 Records Without Authorization appeared first on HIPAA Journal.