Essentia Health, an integrated health system serving Minnesota, Wisconsin, North Dakota, and Idaho, is sending notifications to more than 1,000 patients alerting them to the exposure of some of their protected health information (PHI).

Like many healthcare providers, Essentia Health works with a third-party vendor that provides billing services to help recover lost revenue. Those services were provided by a Bruno, MN-based billing services firm called Nemadji Research Corporation.

Essentia Health provided Nemadji with certain types of PHI to allow the company to perform its contracted services. Essentia Health did not disclose exactly what types of information were exposed in the substitute breach notice posted on its website.

On March 28, 2019, Nemadji discovered unusual activity in an employee’s email account. The investigation revealed the employee had fallen for a phishing scam and had disclosed login credentials to the attacker. The account was subjected to unauthorized access for a period of several hours before the account was deactivated.

The subsequent investigation revealed the email account contained the PHI of patients of some of its clients. The L.A. Times had previously reported that the phishing attack had exposed the PHI of 14,591 Los Angeles Department of Health Services (DHS) patients. The latest report from Essentia Health shows the breach was more widespread.

It is currently unclear how many of the company’s clients were affected. The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is also unknown how extensive the breach was.

The post More than 1000 Essential Health Patients Impacted by Nemadji Research Corporation Breach appeared first on HIPAA Journal.

Nemadji Research Corporation, doing business as California Reimbursement Enterprises, has announced that an unauthorized individual has gained access to the email account of an employee and may have viewed or copied the protected health information (PHI) of its clients’ patients.

California Reimbursement Enterprises is a business associate of several healthcare facilities and hospitals in California and provides patient eligibility and billing services. The company also provides services to the Los Angeles County Department of Health Services (DHS).

A potential email account breach was detected on March 28, 2019 when IT staff identified unusual activity in an employee’s email account. Assisted by a third-party computer forensics expert, Nemadji determined the employee responded to a phishing email the same day and the attacker accessed the account for several hours.

All emails in the account were checked and on June 5, 2019, Nemadji confirmed that patient information had been exposed and notifications were issued to affected business partners.

The breached email account contained correspondence between California Reimbursement Enterprises and DHS related to the services provided. Some of those emails included some individuals’ PHI. Nemadji notified DHS about the breach on June 26, 2019 and confirmed 14,591 DHS patients had been affected.

The information potentially viewed of copied was limited to names in combination with one or more of the following data elements: Address, telephone number, date of birth, medical record number, patient account number, admission date(s), discharge date(s), Medi-Cal ID number, month, and year of service. Four patients also had diagnostic codes exposed and two patients had their Social Security number exposed.

Affected patients have been offered complimentary credit monitoring and identity theft protection services and were sent breach notifications on July 8, 2019.

Nemadji has reviewed its cybersecurity defenses and additional security measures have been implemented to reduce the risk of further breaches. Employees have been given additional training and email security protections have been enhanced.

The post Phishing Attack on California Business Associate Impacts 14,591 DHS Patients appeared first on HIPAA Journal.

Alive Hospice in Nashville, TN, a provider of end-of-life care, palliative care, bereavement support and community education in middle Tennessee, has announced that the email account of an employee was subjected to unauthorized access in May 2019.

Around May 6, 2019, suspicious activity was detected in an employee’s email account. The password for the account was immediately changed and an investigation was launched into the cause of the breach.

The investigation revealed the email account was compromised on May 4, 2019 and hackers had access to the email account for a period of two days. Only one email account was compromised. Unauthorized account access was confirmed, but no evidence was found to suggest any patient information was accessed or stolen.

The types of information in emails and email attachments varied from patient to patient and may have included the following types of PHI in addition to a patient’s name: Date of birth, Social Security number, driver’s license number, financial account number, medical history, treatment information, prescription information, treating or referring physician information, medical record number, health insurance information, Medicare or Medicaid number, username/email and password information.

Alive Hospice has conducted a review of its security protections and will be implementing additional safeguards to help prevent further attacks.  Affected individuals have been offered complimentary credit monitoring and identity theft protection services.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights but the incident has yet to appear on the OCR breach portal, so it is currently unclear how many individuals have been affected.

Californian Medical Staffing Agency Victim of Phishing Attack

The Roseville, CA-based medical staffing agency Flexcare LLC has discovered it has been the victim of a phishing attack.

The email account of a single employee was temporarily compromised as a result of a response to a phishing email. The agency’s email security system detected unusual activity in the account shortly after the phishing email was received and the account was automatically shut down.

Computer forensic professionals were hired to help analyze the breach and determine whether the attacker gained access to the employee’s email account and whether any PHI had been viewed or copied.

Despite the prompt account shut down, the investigation confirmed that the account had been subjected to unauthorized access. While no evidence of data access or data theft were found, the forensics investigators concluded that during the time that access was possible, patients’ PHI may have been viewed or copied.

A detailed analysis of emails in the compromised account revealed affected patients had their name exposed along with one of more of the following types of PHI: Address, date of birth, driver’s license number, Social Security number, medical information such as vaccination history, drug test results, and annual health questionnaire answers.

Flexcare will be providing employees with further training on email and network security and multi-factor authentication is being implemented. Affected individuals have been offered 12-month free membership to CyberScout credit monitoring and identity theft protection services.

The post Sensitive Data Potentially Compromised in Tennessee Hospice Phishing Attack appeared first on HIPAA Journal.

Akron, Ohio-based Summa Health has discovered an unauthorized individual has gained access to four employee email accounts containing patients’ protected health information (PHI).

Summa Health became aware of the breach on May 1, 2019 and launched an investigation that revealed 2 email accounts had been breached in August 2018, and a further two accounts between March 11, 2019 and March 29, 2019.

All four accounts were immediately secured and a third-party computer forensics firm was hired to determine whether any patient information had been accessed or stolen. The firm found no evidence of data theft or PHI access, although it was not possible to rule out the possibility that patient information was compromised in the breach.

An analysis of the compromised accounts revealed they contained the following types of PHI: Patient names, dates of birth, medical record numbers, patient account numbers, clinical information, and treatment information.

In total, 10,893 patients were affected. A small subset of those patients also had their Social Security numbers and/or driver’s license numbers exposed.

On June 28, 2019, Summa Health submitted two separate breach reports to OCR for the August and March attacks, one affecting 7989 individuals and the other affecting 2,904 individuals.

Complimentary credit monitoring and identity protection services have been offered to patients whose Social Security number or driver’s license number was exposed.

Summa Health will be reinforcing employee training on privacy and security and additional security measures will be implemented to improve email security.

Community Physicians Group Phishing Attack Impacts 5,400 Patients

Siloam Springs, AR-based Community Physicians Group is alerting 5,400 patients that their PHI has been exposed as a result of a phishing attack.

The breach was detected on April 24, 2019 when suspicious activity was identified in an email account. An investigation revealed malicious software had been installed on February 19, 2019 which allowed access to be gained to the email account.

The email account contained PHI in email attachments. The exposed information was limited to names, medical record numbers, dates of service, and a brief description of the nature of the visit. No Social security numbers, financial information, or other highly sensitive information were exposed.

The malware has now been removed and security has been improved with a new cloud-based anti- malware protection system.

Addison County Home Health & Hospice Email Breach Reported

758 patients of Addison County Home Health & Hospice in Vermont are being notified that some of their PHI has been exposed as a result of a recent email security breach.

The breach was discovered on April 26, 2019 and the investigation revealed unauthorized access to the account was first gained on February 19, 2019.

An analysis of the emails in the account revealed they contained names, clinical information, and for certain patients, medical record numbers and Social Security numbers.

A free 12-month membership to credit monitoring and identity protection services has been offered to individuals whose Social Security number was exposed.

The hospice will be augmenting its technical security controls and further training will be provided to employees to help them identify phishing emails.

The post PHI of 10,893 Summa Health Patients Potentially Compromised in Phishing Attack appeared first on HIPAA Journal.

A MongoDB database containing the personal records of around 5 million individuals has been left exposed on the internet.

The database contained personal information and health data and belonged to MedicareSupplement.com, a website run by TZ Insurance Solutions which helps individuals find a Medigap insurance plan. Individuals looking for coverage can visit the website to find out more about suitable health plans and can obtain quotes by filling out an online form and entering their personal information.

Researchers from Compariteh and security researcher Bob Diachenko discovered the database on May 13, 2019. The marketing database contains information such as name, address, telephone number, email address, IP address, date of birth, gender, and information relating to health, life, auto, and supplemental insurance.  Around 239,000 records included the area of insurance interest.

It is unclear for how long the database was exposed, but it was indexed by the search engine BinaryEdge on May 10, 2019.

The researchers reported the breach to MedicareSupplement.com but no response was received, although the database has now been secured and is no longer accessible.

As a result of the lack of authentication controls it would have been possible for a hacker to delete or alter data or install malware on the system.

Summa Health Patients Notified of Data Breach

An unauthorized individual has gained access to the email accounts of several employees of the Akron, OH hospital system Summa Health and potentially viewed or copied patient information.

The email accounts were discovered to have been compromised on May 1, 2019. The Summa Health investigation confirmed that two employee email accounts had been compromised in August 2018, with a further two accounts compromised on March 11 and March 29 as a result of employees responding to phishing emails.

Summa Health hired a leading computer forensics firm to investigate the breach. The company confirmed that the accounts had been accessed and PHI had potentially been viewed. No evidence was uncovered to suggest any patient information was viewed or stolen, but the possibility could not be ruled out.

For the majority of patients, the types of information that were exposed were limited to names, dates of birth, patient account numbers, medical record numbers, and some clinical and treatment information. A small subset of patients also had their Social Security number or driver’s license number exposed.

Summa Health will be implementing additional security measures to prevent further email security breaches and staff will be provided with additional training on privacy and security.

Summa Health has not confirmed how many patients were affected other than saying the breach impacted more than 500 individuals.

The post 5 Million Records Exposed Due to Unsecured MongoDB Marketing Database appeared first on HIPAA Journal.