Community Psychiatric Clinic in Seattle, WA, a provider of accredited outpatient, mental health treatment, and counselling services, has experienced two security breaches in which patient information may have been compromised. In both cases, an unauthorized individual gained access to an employee’s Microsoft Office 365 account.

The first security breach was detected on March 12, 2019 when an employee’s account was subjected to unauthorized access. The affected account was immediately secured, passwords were changed, and the employee’s hard drive was restored.  The email account also had additional protections added to prevent similar breaches from occurring in the future. The investigation did not uncover any evidence to suggest that patient data had been stolen.

Around two months later on May 8, 2019, a second email account was discovered to have been compromised in a separate attack. The attacker used the email account to send a fraudulent wire transfer request to another member of staff. The transfer was executed, but due to the fast response of the clinic, it was possible to recover all the funds. A password reset was performed to lock out the attackers and additional protections have now been implemented on the breached account to reduce the risk of further attacks. Again, no evidence was found to suggest patient information had been stolen.

A forensic investigation revealed that in addition to the above two accounts, a further two accounts had also been compromised. The investigators note that since the attackers accessed the mailboxes through Outlook Web Access, it significantly reduced the potential for large scale data exfiltration. The lack of evidence of data exfiltration suggests the attackers did not succeed in obtainment patient information, but patients have been notified as a precaution.

The breaches have yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal so it is currently unclear how many patients have been affected.

The post Email Security Breaches Expose PHI of Seattle Community Psychiatric Clinic Patients appeared first on HIPAA Journal.

A database containing the personal information of individuals who had expressed an interest in Amarin Pharma’s cholesterol drug Vascepa® has been exposed online.

The database was maintained by third party vendor and contained information such as full names, addresses, telephone numbers, email addresses, medications, and interest in a copay card for Vascepa®.

Amarin learned of the breach via media reports of an exposed database containing information of Amarin customers and immediately launched an investigation. The company quickly determined which database had been exposed and took steps to suspend active data feeds and the database was secured the same day.

The vendor’s investigation revealed a database misconfiguration had occurred which rendered the database accessible online between May 2, 2018 and June 20, 2019.

An investigation by the vendor confirmed that the database had been subjected to unauthorized access by a third party between May 29, 2019 and June 20, 2019, and during that time data had been copied.

Amarin and its vendor are continuing to investigate the breach and the database will not be brought back online until additional safeguards have been implemented to prevent any further accidental disclosures.

According to vpnMentor, the database contained the records of approximately 78,000 individuals. A second database containing transaction information was also exposed.

Database of Billing and Insurance Data Processing Vendor Exposed Online

Another exposed database was discovered by security researchers at UpGuard. The database was stored in an unsecured Amazon S3 bucket and contained around 14,000 documents containing a range of medical, personal and financial information. The database was tracked to the billing and insurance data processing vendor Medico.

Spreadsheets, documents, PDF files, text files, and images were accessible through the database. Those files contained names, contact information, banking information, insurance information, Social Security numbers, usernames, passwords, prescription information, other personal and medical information. Most of the information dated from 2018.

UpGuard notified the vendor of the unsecured S3 bucket and the database and files were secured the same day. It is unclear whether the information had been subjected to unauthorized access prior to its discovery by UpGuard researchers.

The post PHI of Tens of Thousands of Patients Exposed Online Due to Database Misconfiguration appeared first on HIPAA Journal.

Three more healthcare organizations have announced they have been affected by the data breach at American Medical Collection Agency (AMCA): West Hills Hospital & Medical Center in California, Inform Diagnostics, and CompuNet Clinical Laboratories.

The AMCA data breach was first announced more than two months ago. Most of the companies impacted by the breach were notified by AMCA in May/June that some of their patients’ data had potentially been compromised, but it has taken several weeks for those companies to be provided with sufficient information to make announcements and sent notification letters.

The breach at AMCA occurred between August 1, 2018 and March 30, 2019. During that period, an unauthorized individual had access to a web payment page, through which it was possible to obtain personal and financial information. Affected individuals had had their information passed to AMCA to collect outstanding bills for medical services.

The latest announcements bring the total number of companies known to have been affected to 21. It is not yet known how many patients of West Hills Hospital and Medical Center have been affected, but as it stands, the total victim count is at least 24,390,307. It may take several weeks before the final victim count is known and all of those individuals receive their breach notification letters.

West Hills Hospital and Medical Center

West Hills Hospital and Medical Center in West Hills, CA, uses a company called United WestLabs (UWL)to manage its reference laboratory. United WestLabs was informed by AMCA on June 12, 2019, that it had been impacted by the breach. Affected patients had their name, address, patient account number, amount owed, and service dates compromised. Some patients also had their credit or debit card number exposed.

AMCA has sent breach notification letters to all individuals whose financial information was exposed. All other affected West Hills patients are being notified by the hospital. West Hills Hospital and United WestLabs have now stopped using AMCA’s services.

Inform Diagnostics

Inform Diagnostics is an Irving, TX-based provider of pathology laboratory services. On June 30, 2019, the company was notified by AMCA’s holding company, Retrieval Masters Creditors Bureau, that personal and payment information had been accessed by a hacker. That information included first and last names, banking information, credit/debit card numbers, Social Security numbers, service dates, and names or referring physicians. 173,690 Inform Diagnostics patients are known to have been affected.

CompuNet Clinical Laboratories

Dayton, OH-based laboratory service provider CompuNet Clinical Laboratories was notified by AMCA on June 5, 2019 that the company had been affected by the breach.

The data exposed included names, dates of birth, service dates, medical service provider names, names of referring physicians, health insurance information, and other medical information. A subset of patients also had their Social Security number, credit/debit card number, and/or financial information exposed. Approximately 111,000 patients are known to have been affected.

Companies Known to Have Been Affected by the AMCA Data Breach

The post Further 185,000 Individuals Affected by AMCA Data Breach appeared first on HIPAA Journal.

New Mexico-based Presbyterian Healthcare Services is notifying approximately 183,000 patients and health plan members that some of their protected health information (PHI) has been exposed in a recent security breach.

On or around May 6, 2019, several Presbyterian Healthcare Services employees received phishing emails. Certain employees responded to the emails and inadvertently disclosed their credentials to the attackers. Those credentials were used to gain access to accounts containing sensitive information such as names, dates of birth, and Social Security numbers.

Presbyterian Healthcare Services became aware of the breach on June 9 and immediately secured the affected accounts. The breach investigation uncovered no evidence to suggest any personal information was accessed or stolen by the attacker and no reports been received to suggest any PHI has been misused.

The breach affected approximately 21% of Presbyterian Healthcare Services patients and plan members. Affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months and have been advised to monitor their accounts and explanation of benefits statements carefully for any sign of fraudulent activity.

Presbyterian Healthcare Services is taking steps to improve email security to prevent any further breaches of this nature in the future.

3,812 Patients Affected by Three Rivers Community Health Group Phishing Attack

Perry County Medical Center, Inc. d/b/a Three Rivers Community Health Group, has discovered an unauthorized individual has gained access to the email account of one of its employees and may have viewed patient information.

The account breach was discovered on May 28, 2019. A forensic investigation was conducted by external computer experts who determined that patient information such as names, dates of birth, dates of service, physicians’ names, prescription information, health insurance group, and ID numbers may have been accessed. No financial information or Social Security numbers were breached.

No evidence of unauthorized data access or data theft were uncovered and the community health group is unaware of any instances of identity theft or misuse of PHI. As a precaution, all affected individuals have been offered complimentary credit monitoring and identity theft protection services.

The attack has prompted a review of privacy and security controls and additional protections will be implemented as appropriate to enhance email security.

The post Presbyterian Healthcare Services Data Breach Impacts 183,000 Patients appeared first on HIPAA Journal.

Imperial Health, a physicians’ network serving patients in Southwest Louisiana, is alerting more than 111,000 patients that some of their protected health information has potentially been compromised in a recent ransomware attack.

An unauthorized party had succeeded in downloading ransomware onto the network, which encrypted files and a database used by the Imperial Health’s Center for Orthopaedics (CFO). The attack was detected on May 19, 2019.

The database contained the protected health information of 116,262 patients. While no evidence of data access or data theft was uncovered during the investigation, it was not possible to rule out a breach of PHI. The decision was therefore taken to issue notifications to affected patients to allow them to take step to eliminate any risk of harm.

The information stored in the database related to patients who had previously received medical services at CFO. The information varied from patient to patient and may have included name, address, telephone number, birth date, Social Security number, medical record number, diagnoses, treatment information, medications, dates of service, treating physician, and other clinical information.

The incident has been reported to law enforcement and Imperial Health is assisting with the investigation. Imperial Health has removed the ransomware from its network and has successfully restored data. New anti-virus software has now been deployed to better deal with the threat from malware and ransomware in the future.

Lost Laptop Contained PHI of 1,500 Patients

The Philadelphia Department of Behavioral Health and Intellectual Disability Services (DBHIDS) has announced that a laptop computer containing the protected health information of approximately 1,500 patients has been lost. The laptop was password-protected but not encrypted.

The laptop computer was in a briefcase which was lost on public transport. The laptop contained information such as names, dates of birth, MCI numbers, service provider names, and Medicaid waiver services that the client had applied for or was receiving.

All 1,500 affected individuals were notified of the breach the same day that the laptop was lost and have been offered one year of credit monitoring services at no cost. A forensic review confirmed that the laptop had not been used to access patient records.

It is DBHIDS policy for all laptop computers to be encrypted and it is unclear how this device was missed. DBHIDS will conduct a review and will ensure all laptop computers are encrypted, staff will be re-assigned to the HIPAA Basics training course, and further training on security-focused topics will also be provided.

The post Imperial Health Ransomware Attack Impacts More Than 111,000 Patients appeared first on HIPAA Journal.